www.onworks.net Open in urlscan Pro
2606:4700:20::681a:caa Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.onworks.net/playonline/index.php
Effective URL:
https://www.onworks.net/onworkssession.php
Submission: On October 10 via manual (October 10th 2024, 7:40:53 pm UTC) from US — Scanned from US

Summary HTTP 390 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 61 IPs in 8 countries across 56 domains to perform 390 HTTP transactions. The main IP is 2606:4700:20::681a:caa, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.onworks.net. The Cisco Umbrella rank of the primary domain is 283185.
TLS certificate: Issued by WE1 on September 4th 2024. Valid for: 3 months.

This is the only time www.onworks.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 13	2606:4700:20:... 2606:4700:20::681a:caa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a02:c206:220... 2a02:c206:2202:9398::1	51167 (CONTABO) (CONTABO)
19	2a02:c206:221... 2a02:c206:2217:8560::1	51167 (CONTABO) (CONTABO)
2	2607:f8b0:400... 2607:f8b0:400d:c03::61	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:400d:c0c::5e	15169 (GOOGLE) (GOOGLE)
7	2606:4700::68... 2606:4700::6812:1f31	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:400d:c09::8b	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:400d:c0e::9a	15169 (GOOGLE) (GOOGLE)
1 13	2607:f8b0:400... 2607:f8b0:400d:c0b::9c	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:400d:c0b::9d	15169 (GOOGLE) (GOOGLE)
6 14	2620:100:a00b... 2620:100:a00b::12	19750 (AS-CRITEO) (AS-CRITEO)
12	2620:100:a00b::4 2620:100:a00b::4	19750 (AS-CRITEO) (AS-CRITEO)
1	2600:9000:20e... 2600:9000:20ed:8600:a:e047:754:afe1	16509 (AMAZON-02) (AMAZON-02)
1	108.138.128.124 108.138.128.124	16509 (AMAZON-02) (AMAZON-02)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	104.18.35.167 104.18.35.167	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:24f... 2600:9000:24f1:f400:10:dd8:5e40:93a1	16509 (AMAZON-02) (AMAZON-02)
19	3.171.139.30 3.171.139.30	16509 (AMAZON-02) (AMAZON-02)
6	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
12	141.95.98.65 141.95.98.65	16276 (OVH) (OVH)
12	74.119.117.17 74.119.117.17	19750 (AS-CRITEO) (AS-CRITEO)
12	2606:4700:20:... 2606:4700:20::ac43:4bf1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	172.67.68.162 172.67.68.162	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	125.253.89.178 125.253.89.178	19437 (SS-ASH) (SS-ASH)
6	185.167.164.52 185.167.164.52	198622 (ADFORM) (ADFORM)
6	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
6	147.135.119.115 147.135.119.115	16276 (OVH) (OVH)
6	18.164.124.86 18.164.124.86	16509 (AMAZON-02) (AMAZON-02)
6	3.233.167.98 3.233.167.98	14618 (AMAZON-AES) (AMAZON-AES)
2 8	68.67.160.75 68.67.160.75	29990 (ASN-APPNEX) (ASN-APPNEX)
6	2606:ae80:147... 2606:ae80:1471:12::500	25751 (VALUECLICK) (VALUECLICK)
6	2606:4700:440... 2606:4700:4400::6812:22b2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2620:100:a00b... 2620:100:a00b::30	19750 (AS-CRITEO) (AS-CRITEO)
6	185.106.140.18 185.106.140.18	7979 (SERVERS-COM) (SERVERS-COM)
1 2	34.120.135.53 34.120.135.53	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.225.218.10 3.225.218.10	14618 (AMAZON-AES) (AMAZON-AES)
6	162.19.138.117 162.19.138.117	16276 (OVH) (OVH)
1	2606:4700::68... 2606:4700::6812:1791	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.232.0.61 3.232.0.61	14618 (AMAZON-AES) (AMAZON-AES)
2 8	172.98.26.246 172.98.26.246	399668 (E-PLANNING-) (E-PLANNING-)
6 6	23.105.12.116 23.105.12.116	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
4 6	37.157.6.237 37.157.6.237	198622 (ADFORM) (ADFORM)
7	2607:f8b0:400... 2607:f8b0:400d:c02::9b	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:400d:c01::84	15169 (GOOGLE) (GOOGLE)
2 3	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
21	2607:f8b0:400... 2607:f8b0:400d:c0d::84	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:400d:c0c::6a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c1d::5f	15169 (GOOGLE) (GOOGLE)
1	209.85.144.154 209.85.144.154	15169 (GOOGLE) (GOOGLE)
1	159.89.25.223 159.89.25.223	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
17	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
6	52.2.246.163 52.2.246.163	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:400d:c01::5e	15169 (GOOGLE) (GOOGLE)
6	125.253.89.176 125.253.89.176	19437 (SS-ASH) (SS-ASH)
6	151.101.129.108 151.101.129.108	54113 (FASTLY) (FASTLY)
6	2606:4700:303... 2606:4700:3030::ac43:8a0d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	54.158.240.101 54.158.240.101	14618 (AMAZON-AES) (AMAZON-AES)
3 24	216.22.16.9 216.22.16.9	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
1 1	172.217.197.156 172.217.197.156	15169 (GOOGLE) (GOOGLE)
2 2	54.211.170.34 54.211.170.34	14618 (AMAZON-AES) (AMAZON-AES)
1	67.220.226.233 67.220.226.233	16509 (AMAZON-02) (AMAZON-02)
1 1	74.119.117.16 74.119.117.16	19750 (AS-CRITEO) (AS-CRITEO)
1	51.222.241.106 51.222.241.106	16276 (OVH) (OVH)
1 1	34.36.216.150 34.36.216.150	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 4	2606:ae80:145... 2606:ae80:1451:11::2040	25751 (VALUECLICK) (VALUECLICK)
2 2	2620:112:f008... 2620:112:f008:200::101	26120 (RHYTHMONE) (RHYTHMONE)
1 1	185.167.164.42 185.167.164.42	198622 (ADFORM) (ADFORM)
2	3.208.132.83 3.208.132.83	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:9000:284... 2600:9000:2840:6c00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 4	35.211.202.130 35.211.202.130	15169 (GOOGLE) (GOOGLE)
1 1	198.24.160.76 198.24.160.76	() ()
1 1	169.197.150.8 169.197.150.8	398989 (DEEPINTENT) (DEEPINTENT)
1 1	2600:1f18:765... 2600:1f18:765:4800:9d6a:a737:df26:4f81	14618 (AMAZON-AES) (AMAZON-AES)
390	61

13 2606:4700:20::681a:caa (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.onworks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:c206:2202:9398::1 (Düsseldorf, Germany)

ASN51167 (CONTABO, DE)

downloads.uptoplay.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a02:c206:2217:8560::1 (Düsseldorf, Germany)

ASN51167 (CONTABO, DE)

stream.onworks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.onworks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c03::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0c::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6812:1f31 (United States)

ASN13335 (CLOUDFLARENET, US)

stpd.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c09::8b (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:400d:c0e::9a (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:400d:c0b::9c (Morganton, United States) 1 redirects

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:400d:c0b::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2620:100:a00b::12 (United States) 6 redirects

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2620:100:a00b::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ed:8600:a:e047:754:afe1 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.128.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-124.jfk50.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.35.167 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:24f1:f400:10:dd8:5e40:93a1 (United States)

ASN16509 (AMAZON-02, US)

connectid.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 3.171.139.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-171-139-30.jfk52.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 141.95.98.65 (France)

ASN16276 (OVH, FR)
PTR: ns3216659.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 74.119.117.17 (United States)

ASN19750 (AS-CRITEO, US)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:20::ac43:4bf1 (United States)

ASN13335 (CLOUDFLARENET, US)

script.4dex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.67.68.162 (United States)

ASN13335 (CLOUDFLARENET, US)

prebid-stag.setupad.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 125.253.89.178 (United States)

ASN19437 (SS-ASH, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.167.164.52 (Denmark)

ASN198622 (ADFORM, DK)

adx2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, CY)
PTR: ip-185-184-8-90.rtbhouse.net

prebid-eu.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 147.135.119.115 (United States)

ASN16276 (OVH, FR)
PTR: ip115.ip-147-135-119.us

prg.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.164.124.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-124-86.jfk50.r.cloudfront.net

hb.yellowblue.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.233.167.98 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-167-98.compute-1.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 68.67.160.75 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:ae80:1471:12::500 (United States)

ASN25751 (VALUECLICK, US)

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:4400::6812:22b2 (United States)

ASN13335 (CLOUDFLARENET, US)

mp.4dex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:100:a00b::30 (United States)

ASN19750 (AS-CRITEO, US)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.106.140.18 (Netherlands)

ASN7979 (SERVERS-COM, US)

rtb.adxpremium.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.135.53 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.225.218.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.19.138.117 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533568.ip-162-19-138.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1791 (United States)

ASN13335 (CLOUDFLARENET, US)

cadmus.script.ac	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.232.0.61 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-0-61.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.98.26.246 (Ashburn, United States) 2 redirects

ASN399668 (E-PLANNING-, US)
PTR: ads.us.e-planning.net

ads.us.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.105.12.116 (Manassas, United States) 6 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

ssbsync-global.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.157.6.237 (Denmark) 4 redirects

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:400d:c02::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:400d:c01::84 (Morganton, United States)

ASN15169 (GOOGLE, US)

e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.159.8 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2607:f8b0:400d:c0d::84 (Morganton, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:400d:c0c::6a (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c1d::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.85.144.154 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: qv-in-f154.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.89.25.223 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

node.setupad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.2.246.163 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-246-163.compute-1.amazonaws.com

pbs-cs.yellowblue.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c01::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 125.253.89.176 (United States)

ASN19437 (SS-ASH, US)

sync.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.129.108 (San Francisco, United States)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:3030::ac43:8a0d (United States)

ASN13335 (CLOUDFLARENET, US)

adxbid.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.158.240.101 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-158-240-101.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 216.22.16.9 (Manassas, United States) 3 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.197.156 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: qa-in-f156.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.211.170.34 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-211-170-34.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.220.226.233 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.117.16 (United States) 1 redirects

ASN19750 (AS-CRITEO, US)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.222.241.106 (Canada)

ASN16276 (OVH, FR)
PTR: haproxy-ca-012.roqad.pl

wt.rqtrk.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.36.216.150 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 150.216.36.34.bc.googleusercontent.com

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:ae80:1451:11::2040 (United States) 4 redirects

ASN25751 (VALUECLICK, US)

equativ-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:112:f008:200::101 (United States) 2 redirects

ASN26120 (RHYTHMONE, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.167.164.42 (Denmark) 1 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.208.132.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-132-83.compute-1.amazonaws.com

ms-cookie-sync.presage.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2840:6c00:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.211.202.130 (North Charleston, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: 130.202.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.24.160.76 (None, ) 1 redirects

ASN- ()

server.cpmstar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.197.150.8 (United States) 1 redirects

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:765:4800:9d6a:a737:df26:4f81 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pxl.iqm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	smartadserver.com 9 redirects prg.smartadserver.com — Cisco Umbrella Rank: 1960 ssbsync-global.smartadserver.com — Cisco Umbrella Rank: 1767 rtb-csync.smartadserver.com — Cisco Umbrella Rank: 739	28 KB
33	criteo.com 7 redirects gum.criteo.com — Cisco Umbrella Rank: 461 mug.criteo.com — Cisco Umbrella Rank: 3626 bidder.criteo.com — Cisco Umbrella Rank: 745 dis.criteo.com — Cisco Umbrella Rank: 650	13 KB
32	onworks.net 1 redirects www.onworks.net — Cisco Umbrella Rank: 283185 stream.onworks.net images.onworks.net	107 KB
29	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 116 e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com 0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 163 57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com	85 KB
23	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 535 eb2.3lift.com — Cisco Umbrella Rank: 415	6 KB
21	setupad.net prebid-stag.setupad.net — Cisco Umbrella Rank: 53378	15 KB
20	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 215 googleads.g.doubleclick.net Failed cm.g.doubleclick.net — Cisco Umbrella Rank: 283	167 KB
19	adlightning.com tagan.adlightning.com — Cisco Umbrella Rank: 2602	98 KB
18	4dex.io script.4dex.io — Cisco Umbrella Rank: 3596 mp.4dex.io — Cisco Umbrella Rank: 3227	29 KB
14	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 267 acdn.adnxs.com — Cisco Umbrella Rank: 613 secure.adnxs.com — Cisco Umbrella Rank: 479	19 KB
13	adform.net 5 redirects adx2.adform.net — Cisco Umbrella Rank: 17012 cm.adform.net — Cisco Umbrella Rank: 1528 c1.adform.net — Cisco Umbrella Rank: 604	7 KB
12	yellowblue.io hb.yellowblue.io — Cisco Umbrella Rank: 1567 pbs-cs.yellowblue.io — Cisco Umbrella Rank: 4668	4 KB
12	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 777 sync.a-mo.net — Cisco Umbrella Rank: 1710	7 KB
12	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 522	9 KB
12	criteo.net static.criteo.net — Cisco Umbrella Rank: 776	44 KB
10	dotomi.com 4 redirects web.hb.ad.cpe.dotomi.com — Cisco Umbrella Rank: 4379 equativ-match.dotomi.com — Cisco Umbrella Rank: 3534	3 KB
8	e-planning.net 2 redirects ads.us.e-planning.net — Cisco Umbrella Rank: 2664	699 B
7	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2648 prebid-eu.creativecdn.com — Cisco Umbrella Rank: 8337	2 KB
7	stpd.cloud stpd.cloud — Cisco Umbrella Rank: 49176	782 KB
6	adxbid.info adxbid.info — Cisco Umbrella Rank: 26676
6	google.com www.google.com — Cisco Umbrella Rank: 3
6	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 917	2 KB
6	adxpremium.services rtb.adxpremium.services — Cisco Umbrella Rank: 22603	14 KB
6	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	1 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 307	33 KB
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 517	104 KB
5	openx.net 3 redirects oajs.openx.net — Cisco Umbrella Rank: 2849 google-bidout-d.openx.net — Cisco Umbrella Rank: 2781 eu-u.openx.net — Cisco Umbrella Rank: 3005	1 KB
5	uptoplay.net downloads.uptoplay.net	94 KB
4	bidswitch.net 4 redirects x.bidswitch.net — Cisco Umbrella Rank: 399	905 B
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	21 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	55 KB
2	presage.io ms-cookie-sync.presage.io — Cisco Umbrella Rank: 2219	339 B
2	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 928	915 B
2	sharethrough.com 2 redirects match.sharethrough.com — Cisco Umbrella Rank: 521	687 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 598	850 B
2	yahoo.com connectid.analytics.yahoo.com — Cisco Umbrella Rank: 6925 ups.analytics.yahoo.com — Cisco Umbrella Rank: 495	9 KB
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1011 bcp.crwdcntrl.net — Cisco Umbrella Rank: 976	13 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	170 KB
1	iqm.com 1 redirects pxl.iqm.com — Cisco Umbrella Rank: 1863	794 B
1	deepintent.com 1 redirects match.deepintent.com — Cisco Umbrella Rank: 1097	336 B
1	cpmstar.com 1 redirects server.cpmstar.com	626 B
1	company-target.com 1 redirects s.company-target.com — Cisco Umbrella Rank: 1520	656 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 582	451 B
1	sitescout.com 1 redirects pixel-sync.sitescout.com — Cisco Umbrella Rank: 661	639 B
1	rqtrk.eu wt.rqtrk.eu — Cisco Umbrella Rank: 1818	352 B
1	amazon-adsystem.com aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1138	855 B
1	setupad.com node.setupad.com — Cisco Umbrella Rank: 64718	241 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 89	20 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	2 KB
1	script.ac cadmus.script.ac — Cisco Umbrella Rank: 1583	239 B
1	33across.com cdn-ima.33across.com — Cisco Umbrella Rank: 1183	7 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2261	8 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 3694	4 KB
0	semasio.net Failed uipglob.semasio.net Failed
0	casalemedia.com Failed ssum-sec.casalemedia.com Failed
0	loopme.me Failed csync.loopme.me Failed
390	56

	Domain	Requested by
24	rtb-csync.smartadserver.com	3 redirects
21	prebid-stag.setupad.net	www.onworks.net
19	tagan.adlightning.com	www.onworks.net tagan.adlightning.com
19	securepubads.g.doubleclick.net	1 redirects www.googletagservices.com securepubads.g.doubleclick.net
17	eb2.3lift.com	www.onworks.net
16	tpc.googlesyndication.com	tagan.adlightning.com www.onworks.net
14	gum.criteo.com	6 redirects static.criteo.net tagan.adlightning.com
13	stream.onworks.net	www.onworks.net
13	www.onworks.net	1 redirects www.onworks.net
12	script.4dex.io	www.onworks.net script.4dex.io
12	mug.criteo.com	www.onworks.net
12	id5-sync.com	www.onworks.net
12	static.criteo.net	securepubads.g.doubleclick.net www.onworks.net static.criteo.net
8	ads.us.e-planning.net	2 redirects www.onworks.net
7	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
7	stpd.cloud	www.onworks.net stpd.cloud
6	adxbid.info	www.onworks.net
6	acdn.adnxs.com	www.onworks.net
6	sync.a-mo.net	www.onworks.net
6	pbs-cs.yellowblue.io	www.onworks.net
6	www.google.com	tagan.adlightning.com
6	cm.adform.net	4 redirects www.onworks.net
6	ssbsync-global.smartadserver.com	6 redirects
6	lb.eu-1-id5-sync.com	www.onworks.net
6	rtb.adxpremium.services	www.onworks.net
6	bidder.criteo.com	www.onworks.net
6	mp.4dex.io	www.onworks.net
6	web.hb.ad.cpe.dotomi.com	www.onworks.net
6	ib.adnxs.com	www.onworks.net
6	tlx.3lift.com	www.onworks.net
6	hb.yellowblue.io	www.onworks.net
6	prg.smartadserver.com	www.onworks.net
6	prebid-eu.creativecdn.com	www.onworks.net
6	adx2.adform.net	www.onworks.net
6	prebid.a-mo.net	www.onworks.net
6	cdn.jsdelivr.net	www.onworks.net
6	www.googletagservices.com	stpd.cloud
6	images.onworks.net	www.onworks.net
5	cdn.ampproject.org	tagan.adlightning.com
5	downloads.uptoplay.net	www.onworks.net
4	x.bidswitch.net	4 redirects
4	equativ-match.dotomi.com	4 redirects
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	ms-cookie-sync.presage.io	www.onworks.net
2	ad.turn.com	2 redirects
2	secure.adnxs.com	2 redirects
2	match.sharethrough.com	2 redirects
2	eu-u.openx.net	2 redirects
2	match.prod.bidr.io	2 redirects
2	oajs.openx.net	1 redirects www.onworks.net
2	www.gstatic.com	www.onworks.net
2	www.googletagmanager.com	www.onworks.net www.googletagmanager.com
1	pxl.iqm.com	1 redirects
1	match.deepintent.com	1 redirects
1	server.cpmstar.com	1 redirects
1	s.company-target.com	1 redirects
1	s.ad.smaato.net	1 redirects
1	c1.adform.net	1 redirects
1	pixel-sync.sitescout.com	1 redirects
1	wt.rqtrk.eu
1	dis.criteo.com	1 redirects
1	aax-eu.amazon-adsystem.com
1	cm.g.doubleclick.net	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	node.setupad.com	www.onworks.net
1	www.googleadservices.com	www.onworks.net
1	fonts.googleapis.com	tagan.adlightning.com
1	57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	google-bidout-d.openx.net	tagan.adlightning.com
1	af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	cadmus.script.ac	tagan.adlightning.com
1	ups.analytics.yahoo.com	connectid.analytics.yahoo.com
1	connectid.analytics.yahoo.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	cdn-ima.33across.com	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
0	uipglob.semasio.net Failed
0	ssum-sec.casalemedia.com Failed	www.onworks.net
0	csync.loopme.me Failed	www.onworks.net
0	googleads.g.doubleclick.net Failed	www.onworks.net
390	87

This site contains links to these domains. Also see Links.

Domain
www.megadisk.net
chromewebstore.google.com
www.facebook.com
twitter.com
instagram.com
www.youtube.com
www.linkedin.com
www.offidocs.com
www.apkonline.net
www.uptoplay.net
www.offilive.com
www.redcoolmedia.net

Subject Issuer	Validity	Valid
onworks.net WE1	`2024-09-04` - `2024-12-03`	3 months	crt.sh
uptoplay.net R10	`2024-09-18` - `2024-12-17`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
stpd.cloud WE1	`2024-09-06` - `2024-12-05`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-24` - `2024-12-25`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-24` - `2024-12-21`	3 months	crt.sh
cdn.prod.uidapi.com E6	`2024-09-11` - `2024-12-10`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M02	`2024-09-07` - `2025-10-07`	a year	crt.sh
oa.openxcdn.net WR3	`2024-09-16` - `2024-12-15`	3 months	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-30`	a year	crt.sh
invstatic101.creativecdn.com WR3	`2024-08-17` - `2024-11-15`	3 months	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2024-06-04` - `2024-11-28`	6 months	crt.sh
*.adlightning.com Amazon RSA 2048 M02	`2024-07-30` - `2025-08-27`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
*.id5-sync.com E5	`2024-09-01` - `2024-11-30`	3 months	crt.sh
script.4dex.io WE1	`2024-09-21` - `2024-12-21`	3 months	crt.sh
setupad.net WE1	`2024-09-04` - `2024-12-03`	3 months	crt.sh
*.a-mo.net R10	`2024-09-29` - `2024-12-28`	3 months	crt.sh
track.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-09-03` - `2025-09-24`	a year	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2024-04-05` - `2025-04-30`	a year	crt.sh
*.smartadserver.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-01-17` - `2025-01-16`	a year	crt.sh
*.yellowblue.io Amazon RSA 2048 M03	`2024-03-18` - `2025-04-16`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2024-03-13` - `2025-04-10`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2024-06-17` - `2025-07-19`	a year	crt.sh
mp.4dex.io WE1	`2024-08-29` - `2024-11-27`	3 months	crt.sh
*.adxpremium.services Sectigo RSA Domain Validation Secure Server CA	`2024-07-30` - `2025-08-05`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-08-29` - `2025-02-19`	6 months	crt.sh
*.eu-1-id5-sync.com R10	`2024-09-01` - `2024-11-30`	3 months	crt.sh
script.ac E6	`2024-08-21` - `2024-11-19`	3 months	crt.sh
ads.us.e-planning.net R11	`2024-08-31` - `2024-11-29`	3 months	crt.sh
*.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-27` - `2025-06-18`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2024-08-14` - `2025-08-18`	a year	crt.sh
tpc.googlesyndication.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
misc-sni.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
node.setupad.com R10	`2024-08-21` - `2024-11-19`	3 months	crt.sh
cdn.adnxs.com GeoTrust TLS RSA CA G1	`2024-04-08` - `2025-05-09`	a year	crt.sh
adxbid.info WE1	`2024-09-25` - `2024-12-24`	3 months	crt.sh
*.prod.cloud.ogury.io E6	`2024-10-03` - `2025-01-01`	3 months	crt.sh

This page contains 87 frames:

Primary Page: https://www.onworks.net/onworkssession.php
Frame ID: 7E63B00A3EDCE7428067E24CA3935F9C
Requests: 51 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 87F230DB6407A705B93C70481D1F69FE
Requests: 38 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: C8D65F798DF1BC6CF2E8FAB31EEFFCE7
Requests: 38 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 39F28C2E01B880FE168A4B3BF04C9C9C
Requests: 39 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 98D57BCCDB2E58C972E3AB1F9F8877E3
Requests: 38 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 846BF4C462607C094B20D93EAC732FE9
Requests: 48 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 19D021DD0E52FBEF03A0811C2AF534C7
Requests: 37 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: B02A8FFAC3F1BA4ED29891AE6D56E4E2
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: E0BE9488E382E9D8A1CD1966AC9CED58
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 242BB5D10A661D153A6F6A8E1CFA0355
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: A858BA505148C4B8A19EDC6560E841EF
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: B4969C1A4E1062BAA6F34FC95C95BC18
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: EDC61D3FA9C1157C6E743204441DC4AC
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.onworks.net
Frame ID: 48C8361E5E33267D7A64BA31E1A7CE42
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 581DDC375D732E79017600F4543B1BFE
Requests: 1 HTTP requests in this frame

Frame: https://e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 6C3F2F19EA3569B3625C23E30BB28ECB
Requests: 1 HTTP requests in this frame

Frame: https://e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 34AD8C2277BC2E3254053B54AE12E08C
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 3170800D312208DE74DC65D0C789DA20
Requests: 1 HTTP requests in this frame

Frame: https://0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: BF1D14535C4E135F6B51A194AACADA2B
Requests: 1 HTTP requests in this frame

Frame: https://ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 466E5D88A143BB54879A6BF70E0FBBD7
Requests: 1 HTTP requests in this frame

Frame: https://af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 1E3391D595F549FBF5B9F56D51E7961A
Requests: 1 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 0B58BF41FE709819CF09B0F110C51BCD
Requests: 1 HTTP requests in this frame

Frame: https://57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 8931FD494566578C1F7BE0EEE41B9ADF
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: 08CB7DE590776E4539AA35D279E9D04A
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: AC4ADCAEF288BEA822F0BC6B451F1D65
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: B8D65796378C757C8070F469D7A9FD77
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: EE9B70AAF3FDD489B153A7E054A164D0
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: F882F98E3F71A3191D6DFA23E46C497D
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 1721E3FB526B9A4ECB36ED191C5972E9
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Frame ID: 266DCD0C62C5B69595563C9706D0FE6B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: 123C18F667605BDC5C709F2D4B0C7FF8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E7A03305F33AB93F6A024AFD77E73066
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: ADA2DD87509971D605C31D331C26CA92
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C493B55ECF34BB124F40CE551A353A8F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: BA39D3A756C7EF0240BBC6C74819E9EF
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C07FC83D8AD3EBBAB668D8ED285C9B93
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: C19C143E7B123C15DFA17446CA818BA2
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4F1399806DF5F24A0673223CDC6C23CC
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: A0DAA428AA408CD08302010AA6EDAA0E
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: B98D81ED2550082C4FC401850C281A8E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: 1975AEA7675589F7A8FE384EAFAAB995
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F15BE8BB179AE0D75D3B361EDC720F85
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Frame ID: E5F1B400B1C369BC459BD8D5B1834A7B
Requests: 16 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 16AC1B839D264B669DE24C868A293F61
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: E28FADA99A62DF6E2F6C7C2D1E34D82B
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 37B9F45328929AAA76F6A38D8653C270
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 703BE46963CE53ED65B8305B107FF675
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 5F6C36365B0EA31DA1E2D07D67788C8F
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: 723D7B009EEE38446F3D656262A5C442
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: E8F9C883B3212D6E374BCDC465D4A0AB
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 250BA551D4F18EEF6C838DE67C503B2A
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: D677CBA55899D3CE7800F748A69C7B06
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: 57ACEFCD99E042A70D750E37996F2512
Requests: 1 HTTP requests in this frame

Frame: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Frame ID: 7A89F94083D49991E76B2A3B3BCC29A6
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 75E3244E2C8FC48BA838416ADFA11CB3
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJGI2OTg2NmY1LTFjN2QtNDQ4MC1iODNlLTdlM2EzM2Q3MGMwMqIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: 0DC07E87C08D9D35607B01FF34185A12
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FF9EFB194D00445F1FD9DD04A87905F2
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: AA4F4A917F2250C98213B82435F702F8
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: BFBE57FF000AC928F4FE9574687A181A
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: A74DE6D46E8966AEC6714978571E22A0
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 21E985A9CC9FC1AE8D5DE895419CCB9A
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: 87AA7D1CEFD6B568548EAA1A25FE521C
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDFkZDQ5N2M3LWUyNDMtNDA1Ny1iYjMyLWNiZTU1YjI1YmE5OaIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: B3DED7B2C346793188EC2A656678A674
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 49484A4C5579CA42A42AAF8369EF7433
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 9B74B52DEEE729F202120E2AC5DA64A8
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDhlOTdiMmNkLTE5MjEtNDhiMC1iNDVhLWNhYjhmYmYwZDIwM6IEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: EF8F818CBEE8DBF557588F9AE587D27B
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: FC8BE1768C53DD86CF35EF1D2A90AE46
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 08C250D3CBA9B106E48D56A60511BF43
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: F86B04220C36211605B35C09BDE7BEF5
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJGZlZjBjMzVhLTE1Y2EtNDMxZS04NWViLWIzZGZhYjE3YjJhMKIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: 1C099AC8544D9EC06E3242602CF33B14
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 9645CBE08727D54F1C2EEA7441039C5D
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: 88C40F7DFBB945BB5C4A27EF56EF5656
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 6E24BCA124833536CD402BD2FC9CBDF3
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5E4CA76DFCB9AC6532CC3843F458A195
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: CAC56E6112502D4CDF90B61F136604BD
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDBiZmIzZjg5LTdlNTMtNDExYi1iMDIwLWE1OWZlODQ4MWUyNqIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: 13BAAA249048C27C3ABE093C562C00E7
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 9588214ED69FDBFC9148BABEEAF39057
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: B8570CA95A1755C3BF7C13D6A62C6E73
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: CA6D284B83AB65E9EF957F0813955096
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: E062E614E8DB821FF57709D438F434CE
Requests: 1 HTTP requests in this frame

Frame: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDRiNTBjYTJjLWY1YTMtNGUyNy04YjNiLTZkYjA1MGI1NjE1OKIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Frame ID: 8200E8545652990CD66522C4BC5A8C9D
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 0CE867A3B26AC3CD017A90ECB9B16517
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: C1514B5E4CDD5075C0D1CB6FAB1C7585
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 1ED1CE1744B09C04F56DB44F2916FCBE
Requests: 1 HTTP requests in this frame

Frame: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Frame ID: 7CD5998B21BD19962FB8BFDFA223CF55
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 914A9E9472212D4F6BBEC6EE71EB38A1
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Frame ID: 5356068D1F06976FD6F5361E354AC280
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Session management for OnWorks Free hosting provider for Linux online

Page URL History Show full URLs

https://www.onworks.net/playonline/index.php HTTP 307
https://www.onworks.net/onworkssession.php Page URL

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

390
Requests

86 %
HTTPS

41 %
IPv6

56
Domains

87
Subdomains

61
IPs

8
Countries

1952 kB
Transfer

10982 kB
Size

273
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.megadisk.net/pricing-onworks/
Title: Pricing

Search URL Search Domain Scan URL

URL: https://chromewebstore.google.com/detail/vpnonline-secure-vpn-as-u/ojoiohfkfnfkdcmccickjhkmcdgeeifl
Title: VPN

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OnWorks-114357987913897/

Search URL Search Domain Scan URL

URL: https://twitter.com/onworksglobal

Search URL Search Domain Scan URL

URL: https://instagram.com/onworksglobal

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCggT8SMrUfB6NxjVndr6exA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/onworks-hosting/

Search URL Search Domain Scan URL

URL: https://www.offidocs.com/
Title: OffiDocs

Search URL Search Domain Scan URL

URL: https://www.apkonline.net/
Title: ApkOnline

Search URL Search Domain Scan URL

URL: https://www.uptoplay.net/
Title: UptoPlay

Search URL Search Domain Scan URL

URL: https://www.offilive.com/
Title: Offilive

Search URL Search Domain Scan URL

URL: https://www.megadisk.net/
Title: Megadisk

Search URL Search Domain Scan URL

URL: https://www.redcoolmedia.net/
Title: RedcoolMedia

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.onworks.net/playonline/index.php HTTP 307
https://www.onworks.net/onworkssession.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=hA012XwweTl3REVXYmV4SFRVbEYyYW1uOTRpRVdEczE3djhhNTFPMUltTHQ0VFJESSt6VGxVZkR0elhWZ3FlRjRvUVVnZzNwdmN6NFNabEVEd0U0MHk4LzdTQzJLYm91L1dGbnVucG4yQ0k2ZDRsYzNXNC9ubUxITituQnF1ZHBoT3l1elRrbThiakN1d29SZ3IzdVYwVk9ialA2dzlJWmw1aEtIN21mZHo1cjdoNXVxUW4yQy80ZmRSSmVSczRMZ250V01lVElYK1VDRmpsaWROQ1RhNXZnK25zUU9uek0rU3ZkQm04UXNhcGlpWVhDWnVkLzFOSWtXNGkrNDQ2VVdPMEUwQ3M1ak1HK1BjQTczU2NNZWdPQnp2QT09fA&cppv=2

Request Chain 79

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=OFR7VnwwT2ZabkhTN09DelJrVjZNSUY5alVNaDJQemE1V2I2Mjd2b2loSmYvRkpSbDVNT1RMVFJpaWUybk9sSGhCaUxmcmFjeXZCeXVmQTZzKzdNWWN3VGxoa2Q4OW1uRjRLZXpma3B5SVlGd0YzRldYd051RFVCZUN6N0hIeDd4dU04MEUxNHJKVW8wVHp0d1ZjMHhxVG9nSUhTYkNHQURwMFQ2VWFiSVJGVjhCa1g1bVJybkllNExWZkFOUlh0V3hTVDFZZkM3RDdvdks0YU1TUkFYMlJoREhDOEJqenRESEVPdFlvV3drMVRXV1cyaWxUNTJPSktUMVRCUnJPRzdRQ0plNGt3Ymc0N2JKek93ejY2Mno2RysyZz09fA&cppv=2

Request Chain 85

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=NyNLJHxKdHNOQlFCS1AwdlZOalRISkV1VzV3UUpsZFNKKytyVjl3ckdXRGxKYzBWanQ1cmNQL2c4a3lDaUJONTFjQ0Fac1B4RDRxUDZNSjlpVjBwOXNDaWczN1ppR0tKdktnNVlUM1c0TkhlaDk5TzVRaEU1UXRBdnBsTHdzM0tKMFBDcWJ6b2lJVHVFbG96YjdHMjZpbkpsZ3Q3NmlXc3ZZSVhzc0hHVFR4SjVkRWhTTUZBZzZCckRMUTRXUmlRbGw1T2hmTlZXeHdCOVpiV29LaGV2Q3N0Z3pJZkpyMWVIVi9qVVlMY0crNUZTM0NKb3FzSS9YeTloSjJ6ZHJHZkUydHRhfA&cppv=2

Request Chain 91

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=sTeJpXx2WVU3WlFaZjM5ZzJIclNyUmRRaFJzbmtwZ1RMUDdXZTd6emZJWllldlZIR0JTczFpTHNiSE5VVUFGRUJ4QnJERXBZY0JtMlQ2dDFGY2dCN0FpNFVTSjM0djM3VTI0emhlTTZCTzZ3ZVBjSTVxdlJ1a2w4T0llMmJWUWlYR1A4SE1VOUVoSDdwRS9jamRTeWN3Rm1nMjhXVkxFWGdSUjh1VytFNG5JYUZkYzRSbS9sc05ObFFmdXk5cHN0dkdEa3BKSU1tOGRzVEVrUjBKeG5lOEs1NURpeUMrUW9wN2FjWlEwd21rZlUwY2I4UkxyOXJHTXFIMUNnWHpPcGFkZlVGMTJPV3VBQ0JDbTQ3azBaWVgwekNVUT09fA&cppv=2

Request Chain 97

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=R_tg23xkNGtPa0Q3alJRWkhNZzJVVlEzbit6UW9senh2VmZPa2tQZldpZjM4c1hYUFNBSWxyZFZpd3MwaUNKbGM4cnRORGxYNWwrZ00wRVo2THh1VnFrSlIvaEhsaVJOMENVOVZaZmNiVDJYMWhoNDBaQ0FmbmtaOGNrcCtMclptUExUb3Z2ekwzb29UWExlZ1BHVWI4cGtEMEdBcTNwU052MFpOemQ1cFJ0ZFhFZXpnQk9YRllIVkd1elMveGZJdXZnTTVIZGtIdmp1SE9RWWpIT0h3Q0hFTU5nOWNkbGZEVFBsVnRkMUR4cXhUN0k3MitPN0hXUnVuaHJmRWc0TUt3WFdlTStZYzZDYldYRHpXV2JwMDV2MU40UT09fA&cppv=2

Request Chain 103

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=OiRk4Xx5dU9yaitPMEpqdG1yQlg3OGJyRCtEZ0Z5a3B3NVRmTUtpbTc4bCs0bDhmZFQwL3p3UGNKVU9iUWUvVWs3dkFlYU1QWk1YY0Zzd0lmazdsd09rMlBiQXlEWFJrNjUrVm5DdzdPcEUwbGdjSFpGVkpHd2QvaUh3Zlp1VS9NN0g4eWVRbG1QUEFpT1lGd1N5bTN6a2Q1b1JnUnVPenhyVWJuRkdMVHhxeUtLZUh0ODFxZSsvaDJxZTRhL2JUOFcwblZWZ0puUE1NWDZqQVhEVktyR2pLYWdJNkRyUVFNUlpGdjYwVWRYKzVOOHFTL0ZjU2VLVzBYbnFoV3pJMStGbklUfA&cppv=2

Request Chain 200

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp&cc=1

Request Chain 218

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID HTTP 302
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Request Chain 219

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 229

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 231

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID HTTP 302
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Request Chain 285

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 296

https://securepubads.g.doubleclick.net/pagead/adview?ai=CT6pEvi0IZ878Lpzorr4Pxa21qA-OoezleN6dqPZm4Iq7oOMMEAEgjeS9KWDJxqmLwKTYD6ABz-mI_wPIAQHgAgCoAwHIAwqqBKYCT9C_mm-MR5p1Q-NSb_V_oEhyeUhGW7K7iTMnu0rH5ugzBvFSXFKFS-KW8xFWj9CbEPyyQNAj3wXK9zKvb5-DgoWQGR0UB1gPKuBcGRThFvoF67ZrHL3aHJ1hA3G5tLmhtYJ3S6BDyea4YiPh5wmrfkKRB81ZYzAt_H1RXxL-4AChHF22AMqmJjelPToxD3RH4PUYlG2XRnw7Gg6JRoOEt6ho3ekTB5e_Ax_f3mCRZNqNN-xayUB0wz72YAeu7B7ClF9gXxSvodjvNyPwblU1dkZPibARynC9ledMUYSz8z5RsFh-ZQ76R8orzJckf-Vy_F-alHXH1pYSpxMI7O-x1rD8PEeBS2GeHGiypNjJOq9ooeqxTUgbwADhXmie7MeBmWLlIMZNwATu0ay3FOAEAYgFjo63O5IFBAgEGAGSBQQIBRgEgAeZlneoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcB8gcEEKrTDtIIJgiAYRABGB0yAooCOguAQIDAgICAoKiAAki9_cE6WILsjuDIhIkD8ggbYWR4LXN1YnN5bi0xNjAyNjE4MTYyOTE3NTcymglOaHR0cDovL3d3dy5zbWFydGVyYXNwLm5ldC9pbmRleC5hc3A_Y2FtcGFpZ25pZD0xMSZrZXl3b3JkPWdvb2dsZTkmZ2FkX3NvdXJjZT01gAoDyAsB2gwRCgsQgPjMgYufo47MARICAQPiDRMIipuP4MiEiQMVHLTLAR3FVg316g0TCNaVkODIhIkDFRy0ywEdxVYN9dgTDNAVAZgWAYAXAbIXIAocCAASFHB1Yi0zOTcwMjc3NTM1NTI4NjEzGJXiHxgBuhcCOAGyGAkSAvBZGAEiAQDQGAE&sigh=tsN7kcv23UQ&uach_m=%5BUACH%5D&ase=2&nis=ATTRIBUTION_REPORTING_STATUS&cid=CAQSigEA6Wl537vEdJ1JvaZfbJYXh65ylChC6ZHuTSQblb8m2zuGaKcJ5s5SQ8wVbUqZL5tZNLNRpo3OM9wL6dAtLYzVU0Awwfds9IkvKGmCJPMoQybOnlu7TI8ZDRRWmjXqNxbLwM6OAPDGDmSYQKX-k-aKJoV2dBdbw60GYyjdB48wl9cDq2Px6Y4K33UYAQ HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x8f4e5066451e6d980000000000000000%22,%222%22:%220x4a1a513d6be73e990000000000000000%22,%223%22:%220xfa1a1b601c99fc530000000000000000%22,%224%22:%220x2a4087d4fccf792c0000000000000000%22,%225%22:%220xa5163a3cee1c73ff0000000000000000%22},%22debug_key%22:%2211601413892667001679%22,%22debug_reporting%22:true,%22destination%22:%22https://smarterasp.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221071789263%22],%2222%22:[%22true%22],%224%22:[%2210-10%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213933858613732386193%22}&andc=true

Request Chain 298

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 304

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 305

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 322

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0

Request Chain 323

https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=

Request Chain 324

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=Mzk2NjQ4MDcxNjAxMjEwMDg1NQ==&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEIlg16gd6mNriq6sEyKQ11I&gdpr=0&gdpr_consent=&google_cver=1

Request Chain 326

https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0

Request Chain 331

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=

Request Chain 332

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=3966480716012100855&gdpr=0&gdpr_consent=

Request Chain 333

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fdee39d7-0252-4a71-a492-d80fe3f7e3e9&gdpr=0&gdpr_consent=

Request Chain 334

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26uid%3DSMART_USER_ID%26gdpr_pd%3D0&gdpr=0&gdpr_consent= HTTP 302
https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3966480716012100855&gdpr_pd=0&gdpr=0&gdpr_consent=

Request Chain 335

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=64&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D68%26partneruserid%3D%7BuserId%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=68&partneruserid=895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&gdpr=0&gdpr_consent=

Request Chain 336

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

Request Chain 343

https://equativ-match.dotomi.com/match/bounce/current?networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://equativ-match.dotomi.com/match/bounce/current?DotomiTest=7bd0e0eab4191422&is_secure=true&networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAEn-FuaYffnAIWt1keAQEBAQEBAQCTdvPDsQEBAJN288Ox&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 344

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-9c21SKAgJYN6uJRFJApXeDYLI9h4yvXwo3W5gO6f5w&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/102/8/2.gif?puid=3966480716012100855&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
https://ib.adnxs.com/getuid?https://id5-sync.com/c/102/2/7/3.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/2/7/3.gif?puid=960377318026395464&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/k/264.gif?puid=d565ed3f-30bc-4e74-8e23-a65db5ef6e12&ttl=%%TTL%% HTTP 302
https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
https://id5-sync.com/k/155.gif?puid=AAM0VU7OEFsAABUvhpjfdg&id5AccountNum=155&numCascadesAllowed=9 HTTP 302
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://ps.eyeota.net/match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://id5-sync.com/c/102/123/4/6.gif?puid=19277f2c3b4-1e100000010a57c8&gdpr=0&gdpr_consent= HTTP 302
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F3%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D

Request Chain 345

https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%3D%23GDPR_CONSENT%23&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=

Request Chain 346

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=7492511013085685528&gdpr=0&gdpr_consent=

Request Chain 353

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0

Request Chain 355

https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%3D%23GDPR_CONSENT%23&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=

Request Chain 357

https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=acff26fe62

Request Chain 363

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=

Request Chain 366

https://s.company-target.com/s/eqx?sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D152%26partneruserid%3DPARTNER_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?gdpr=0&gdpr_consent=&issi=1&partnerid=152&partneruserid=7af3d1d6-011b-4452-9d1b-6fa7140e9aaf

Request Chain 367

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Dsmartadserver%26user_id%3D%24UID HTTP 302
https://x.bidswitch.net/sync?dsp_id=440&ssp=smartadserver&user_id=dTo5NzBvVVFUUTZZSXpkbE1RU2k3TTA= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=

Request Chain 369

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

Request Chain 375

https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0

Request Chain 376

https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=

Request Chain 377

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
https://match.deepintent.com/usersync/129/store?id=&ext1=smartadserver&ext2=2ca2151c-3bc8-43cc-8325-705d5f8078c3 HTTP 303
https://x.bidswitch.net/sync?expires=720&dsp_id=422&user_id=di_ef21e5f83fc845b3914f1&ssp=smartadserver&bsw_param=2ca2151c-3bc8-43cc-8325-705d5f8078c3 HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=

Request Chain 378

https://equativ-match.dotomi.com/match/bounce/current?networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://equativ-match.dotomi.com/match/bounce/current?DotomiTest=5678acdc48e41153&is_secure=true&networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAHJqb6L_UNqAIuCS_qAQEBAQEBAQCTdvPDywEBAJN288PL&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 379

https://pxl.iqm.com/i/ck/equativ?cid=SMART_USER_ID&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D154%26partneruserid%3D%7BIQM_COOKIE%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=154&partneruserid=f408c218-d07d-4017-bc89-ccb8963fbf78

Request Chain 387

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

Request Chain 388

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

Request Chain 389

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP 302
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

390 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request onworkssession.php Show response
www.onworks.net/
Redirect Chain

https://www.onworks.net/playonline/index.php
https://www.onworks.net/onworkssession.php

64 KB
17 KB

182ms
181ms

Document
text/html

2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87cc64769a62314612e92ffae77d8875a1efc1bbab37a294b336b7722aec9ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d09157458572363-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
date: Thu, 10 Oct 2024 19:40:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TXlfMVms2Mg3QY8R%2FrlGvmb%2BnBE1YL%2FKFHtAC1iWpW3QaMwqFUcpqn2hGFtrueHWEX%2BnEsFB7b1dtVg2ASE9Ym%2FLa8Upjpqu%2FiMvJJ0BbGi01hrqEpa6BUaelvbHjRsVPjVcJh2FDJhwMpuoDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, X-Auth-Token , Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d091572ee3c2363-EWR
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
date: Thu, 10 Oct 2024 19:40:43 GMT
location: /onworkssession.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2BNwRCADNUDcfbhF3kA2l6VprFAROmbs3e5oLRSH1NP4e2c4LxlbLpLqa9R%2BQ9ITzwYXxf8pCk%2FXEuFW362eB%2F7FOQXKwwYtOO%2FlPr4o0MhF%2Bhgm2ljvVQ0SCbZqY2H7DXNfwwtdNLV%2B1p9veQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload

GET
H2 200 jquery-ui.css
downloads.uptoplay.net/apkdownloader/ 32 KB
6 KB 327ms
91ms Stylesheet
text/css 2a02:c206:2202:9398::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://downloads.uptoplay.net/apkdownloader/jquery-ui.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2202:9398::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

24e077516b89f2a627c538ae9c18493ecd80f1fe367c0528c2cadc62d6601b6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=1200
cross-origin-opener-policy: unsafe-none
content-encoding: gzip
x-content-type-options: nosniff
x-cache-url-1: /apkdownloader/jquery-ui.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
date: Thu, 10 Oct 2024 19:40:44 GMT
x-xss-protection: 1; mode=block
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding

GET
H2 200 jquery.min.js Show response
downloads.uptoplay.net/apkdownloader/ 93 KB
34 KB 416ms
181ms Script
application/x-javascript 2a02:c206:2202:9398::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://downloads.uptoplay.net/apkdownloader/jquery.min.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2202:9398::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: max-age=31536000
cross-origin-opener-policy: unsafe-none
content-encoding: gzip
x-content-type-options: nosniff
x-cache-url-1: /apkdownloader/jquery.min.js
expires: Fri, 10 Oct 2025 12:28:07 GMT
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
date: Thu, 10 Oct 2024 19:40:44 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding

GET
H2 200 jquery-ui.min.js Show response
downloads.uptoplay.net/apkdownloader/ 197 KB
52 KB 416ms
181ms Script
application/x-javascript 2a02:c206:2202:9398::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://downloads.uptoplay.net/apkdownloader/jquery-ui.min.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2202:9398::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

e4bf411611a715a5752d6e80345cd5fa56731a8ff96e54e5212024337a1c6984

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: max-age=31536000
cross-origin-opener-policy: unsafe-none
content-encoding: gzip
x-content-type-options: nosniff
x-cache-url-1: /apkdownloader/jquery-ui.min.js
expires: Fri, 10 Oct 2025 12:28:07 GMT
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
date: Thu, 10 Oct 2024 19:40:44 GMT
x-xss-protection: 1; mode=block
content-type: application/x-javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding

GET
H2 200 theme.css
downloads.uptoplay.net/apkdownloader/ 2 KB
971 B 416ms
181ms Stylesheet
text/css 2a02:c206:2202:9398::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://downloads.uptoplay.net/apkdownloader/theme.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2202:9398::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

7c69058459fdf0b4521ba057f595d6aa938265ccf3095e818150886a7bb5bf44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=1200
cross-origin-opener-policy: unsafe-none
content-encoding: gzip
x-content-type-options: nosniff
x-cache-url-1: /apkdownloader/theme.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
date: Thu, 10 Oct 2024 19:40:44 GMT
x-xss-protection: 1; mode=block
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding

GET
H2 200 styles.css
downloads.uptoplay.net/apkdownloader/ 620 B
824 B 416ms
182ms Stylesheet
text/css 2a02:c206:2202:9398::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://downloads.uptoplay.net/apkdownloader/styles.css?v=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2202:9398::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

9a3272fdc40cb2636333e4ba1bd290adb9c78e01c7af4ae21da20a5cdf54b3b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=1200
cross-origin-opener-policy: unsafe-none
content-encoding: gzip
x-content-type-options: nosniff
x-cache-url-1: /apkdownloader/styles.css?v=2
expires: Fri, 10 Oct 2025 12:27:15 GMT
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
date: Thu, 10 Oct 2024 19:40:44 GMT
x-xss-protection: 1; mode=block
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding

GET
H2 200 general.css
stream.onworks.net/templates/system/css/ 3 KB
1 KB 433ms
179ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/system/css/general.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

3ad9292f7844d507f33f4de3bf19577c9115a8b7bc807f989ab26b19e3c97fe7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-MtMUQyOcDY"
x-original-content-length: 2730
x-cache-url-1: /templates/system/css/general.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 798
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 addons.css
stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/ 1 KB
1 KB 431ms
178ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/addons.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

50f17262769a2476f090fd24ef33caffed8acd6caf684b20bdc90909c5c43758

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-lXdv-Gwc3a"
x-original-content-length: 2795
x-cache-url-1: /plugins/system/jat3/jat3/base-themes/default/css/addons.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 615
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 layout.css
stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/ 1 KB
867 B 345ms
92ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/layout.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

fef0ae74dc3bcf89260cfe9fe70df333bb482dc7e52f129aa73b177426c72152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-1yeZ15PgBe"
x-original-content-length: 3259
x-cache-url-1: /plugins/system/jat3/jat3/base-themes/default/css/layout.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 452
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 template.css
stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/ 20 KB
5 KB 431ms
179ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/template.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

11fefb9c374d241b645ab5030176d8d2af1b3d362b31f20620848af9e0835ec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: MISS
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-C76MovcGZy"
x-original-content-length: 26939
x-cache-url-1: /plugins/system/jat3/jat3/base-themes/default/css/template.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 4983
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 css3.css
stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/ 970 B
658 B 344ms
91ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/plugins/system/jat3/jat3/base-themes/default/css/css3.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

e687ea2f0b101508eb42841e23a305148562e615919a5c646aca1b753bd518a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-Aag-hZxQyz"
x-original-content-length: 2096
x-cache-url-1: /plugins/system/jat3/jat3/base-themes/default/css/css3.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 244
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 layout.css
stream.onworks.net/templates/ja_elastica/css/ 2 KB
939 B 432ms
180ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/layout.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

773485acaee520be797ce2adbd1ae738c1c28b49b11e298ed784edbb11b08a2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-97Bl_gQT9D"
x-original-content-length: 3596
x-cache-url-1: /templates/ja_elastica/css/layout.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 547
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 template-3-new01.css
stream.onworks.net/templates/ja_elastica/css/ 25 KB
6 KB 435ms
183ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/template-3-new01.css?v=020

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

b831ee2bbbdc5353833b35f1176feab0fe3d5a00c04c2576e7de866bced4a3c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: max-age=726, public
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-yFoVuFwV5i"
x-original-content-length: 35313
x-cache-url-1: /templates/ja_elastica/css/template-3-new01.css?v=020
expires: Thu, 10 Oct 2024 19:52:51 GMT
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 6093
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 modules.css
stream.onworks.net/templates/ja_elastica/css/ 1 KB
935 B 435ms
183ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/modules.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

2440da49abf00e2fc8e09c38bbb2ac1afca94303ead6974b746c79155c789b9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-eDveT_ggor"
x-original-content-length: 2543
x-cache-url-1: /templates/ja_elastica/css/modules.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 542
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 layout-normal-2b.css
stream.onworks.net/templates/ja_elastica/css/ 2 KB
1 KB 431ms
179ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/layout-normal-2b.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

28bac19e2c9954e907755a04a23f54e66d170896802b32937d02835afc1aa3ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-GVyzB23AEn"
x-original-content-length: 3637
x-cache-url-1: /templates/ja_elastica/css/layout-normal-2b.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 648
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 css3.css
stream.onworks.net/templates/ja_elastica/css/ 3 KB
1 KB 346ms
95ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/css3.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

56fdceec363758833100b58312eb4993fe9f599ca70117325ccbabe03b7d6d26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-30gcjA_HN3"
x-original-content-length: 3917
x-cache-url-1: /templates/ja_elastica/css/css3.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 670
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 mega.css
stream.onworks.net/templates/ja_elastica/css/menu/ 5 KB
1 KB 434ms
183ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/menu/mega.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

aafd776ec37c9b47abb96dc3199c4dda7aff364fa6ec9f0458822793bee3e890

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-lAK6Sgz8bE"
x-original-content-length: 7009
x-cache-url-1: /templates/ja_elastica/css/menu/mega.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 1083
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
79 KB 80ms
32ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-117545413-4

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

92ad0fdb8501fc67bc5a5e2127b06673b5241bad13f3b8c88287a73e9fa675da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 79917
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 firebase-app.js Show response
www.gstatic.com/firebasejs/5.4.0/ 34 KB
12 KB 52ms
22ms Script
text/javascript 2607:f8b0:400d:c0c::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/5.4.0/firebase-app.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2320f2452434b494e292e5a413126980c134215940ab091e9e496a0052d62f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
age: 50427
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 05:40:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 05:40:16 GMT
last-modified: Thu, 16 Aug 2018 18:59:55 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12419
x-xss-protection: 0
server: sffe

GET
H3 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/5.4.0/ 35 KB
10 KB 56ms
26ms Script
text/javascript 2607:f8b0:400d:c0c::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/5.4.0/firebase-messaging.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

246fef45b3c78c283fb603de040c9263bbb48532dcb057d4045a790b1b149318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
age: 50427
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 05:40:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 05:40:16 GMT
last-modified: Thu, 16 Aug 2018 18:59:55 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10046
x-xss-protection: 0
server: sffe

GET
H3 200 24.png
www.onworks.net/images/ 24 KB
24 KB 26ms
25ms Image
image/webp 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onworks.net/images/24.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b87de489c3eda2d7cc12367ec2cd76c0bd53ff131e63b0068a92acab334a0227

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

cf-bgj: imgq:100,h2pri
etag: "5b05ec18-9860"
age: 1303476
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FTGuAv2QoxfLhSj5V1ho%2B2uwKIhD7Ui3LTS68a2GQDLFzGy17orqUNkcW8mLzEN5uB78j%2BSiBzXHuyskkBT8bwOy9cWc5svrxh2ZCWIO39CtEZvylHzWR309RBVnSZFEPd6P2co2M6mcwX%2BCDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/24.png
cf-polished: origFmt=png, origSize=39008
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/webp
content-disposition: inline; filename="24.webp"
vary: Accept
last-modified: Wed, 23 May 2018 22:32:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d091579398d1811-EWR
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 24384
server: cloudflare

GET
H3 200 menu_x48.png
www.onworks.net/images/ 70 B
742 B 22ms
20ms Image
image/webp 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onworks.net/images/menu_x48.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25377c3b5fdd6f4fe4b3e8f786d6e5a475b99f242487b52b81c0162e67ece722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

cf-bgj: imgq:100,h2pri
etag: "62503f4b-a4f"
age: 27838
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uaggFXkoBuvh48mCWfofN0o0Ds%2BmMKLewRU3VOry59n9prYIpmbAF4Dw%2BIXsGIYNWm3e5xqq3NnDEysvqJsHm00c7EWPFBPw2G5zAj%2Brupjt0OafzIEfJGMcvnEeUvxoy9f02dJNhdEZefNZGA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/menu_x48.png
cf-polished: origFmt=png, origSize=2639
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/webp
content-disposition: inline; filename="menu_x48.webp"
vary: Accept
last-modified: Fri, 08 Apr 2022 13:57:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d09157959a71811-EWR
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 70
server: cloudflare

GET
H3 200 onworkslogox30.png
www.onworks.net/images/ 780 B
1 KB 27ms
24ms Image
image/webp 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onworks.net/images/onworkslogox30.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dc5c3307b9b9a11721bc963c6f44ba98bc586f2cd9740fb0b5064f5f79962cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

cf-bgj: imgq:100,h2pri
etag: "625b025f-b14"
age: 27838
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2FJoq3%2F7XKs7HimSNel%2Flxns7x8Us8isI63wdHscr839G9rqc5GN9pY%2FQjyyZxv7ffJkrdKVyKpV6U0Adyy7ho%2BsLHaJNyTU6fe7VR8jA%2BnkLPaw1tlRgkeE4E2GS6R2BcsCYtROcuAHGM72Ew%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/onworkslogox30.png
cf-polished: origFmt=png, origSize=2836
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/webp
content-disposition: inline; filename="onworkslogox30.webp"
vary: Accept
last-modified: Sat, 16 Apr 2022 17:52:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d09157969ac1811-EWR
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 780
server: cloudflare

GET
H3 200 240px-Search_Icon.svg.png
www.onworks.net/images/ 2 KB
3 KB 21ms
20ms Image
image/webp 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onworks.net/images/240px-Search_Icon.svg.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

101ffbc58574cf8ad9080605fe602a65cdc54445b6eebf60c87bac3fe31bf636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

cf-bgj: imgq:100,h2pri
etag: "5bc8c0e1-fae"
age: 27837
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OwOLofqlUipGECAj3KckuVfSbiZmbY%2BjReStDWx8XICDOFI2WGAABqLCwNF5jHFzjMcfwVbe6Hzb6y6d7xfZbu6F5Cov5jyC%2F1o6eTgi6rV04iptnwdAFZBHGR10IJXXLxevJghJmtAS7wxReA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/240px-Search_Icon.svg.png
cf-polished: origFmt=png, origSize=4014
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:43 GMT
content-type: image/webp
content-disposition: inline; filename="240px-Search_Icon.webp"
vary: Accept
last-modified: Thu, 18 Oct 2018 17:20:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d0915758d4b1811-EWR
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 2462
server: cloudflare

GET
H2 200 stpdwrapper.js Show response
stpd.cloud/assets/ 9 KB
4 KB 111ms
42ms Script
application/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stpd.cloud/assets/stpdwrapper.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

90909d259afbaaa73f4accf86af27e03040ec2540cf1aca4a0a0e5aa8fbdc133

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.onworks.net
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=1200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: MISS
etag: W/"4138a5b1014ef329ccf608f46f48b303"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=83EE3vaJq2rqGccPpD%2FVjJgBaIh%2FEIL8O7bZwKTjsHIikzPn4fCdKnDAFYG%2FV04ipNUMXUSDd2Z%2BS1zRybNLWF7aYOh70%2FehaojfgRwo43b4vNSMUpbv93eLTKPT%2FvYWooJfUW14oY7h"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d091579cafe8c72-EWR
expires: Thu, 10 Oct 2024 20:00:44 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 fedoraicon128.jpg
images.onworks.net/images/ 4 KB
4 KB 345ms
93ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/fedoraicon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

25b8f3aefaa2bbab5d6a50fdb519e28c7c5e68296ae272beb4a75aa46cc298f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: MISS
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-VpGYxLBqE7"
x-original-content-length: 5870
x-cache-url-1: /images/fedoraicon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 4089
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H3 200 readmoreblue2.svg
www.onworks.net/images/ 417 B
861 B 23ms
21ms Image
image/svg+xml 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onworks.net/images/readmoreblue2.svg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bb478b61a1c97d3485a9075de3db15d34e1882a6af6c406516cb869097f859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"626eaf08-1a1"
age: 24957
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VTiTR8%2FbkIZfecUx%2B7tX0YHGtyNTAv9tUX7e3aHJFB1X%2Bytcs9F1XLsPNLnfTtqp1VsBltHFhEWiWKLH3MORJqUluIL6l08zdjBrFCayKVJR%2Fpi3BhxWM5HdiqQf1P%2FUCg%2BtC98sWLw6lQYBYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/readmoreblue2.svg
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Sun, 01 May 2022 16:02:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d09157969ad1811-EWR
cross-origin-embedder-policy: unsafe-none
server: cloudflare

GET
H2 200 windows10icon128.jpg
images.onworks.net/images/ 3 KB
3 KB 322ms
93ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/windows10icon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

52de3fb37e167bc691b7233a515bda92daee4d136e081ec14876f571fa8355d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-Mm96OZd_ek"
x-original-content-length: 4819
x-cache-url-1: /images/windows10icon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 2938
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H2 200 ubuntuicon128.jpg
images.onworks.net/images/ 5 KB
5 KB 91ms
91ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/ubuntuicon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

388bf206c1a54aac2a0f643ea09aa7cd8735cb5eaa18632c4f88e44044f33e15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: MISS
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-Fb0Cg5W2we"
x-original-content-length: 7983
x-cache-url-1: /images/ubuntuicon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 4910
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H2 200 pearosicon128.jpg
images.onworks.net/images/ 2 KB
2 KB 92ms
91ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/pearosicon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

14f29c0d1d5cb9f8871c929af419262d5b724aa2264ba2f47ee774c7b1740e0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-QvM3gMGtUL"
x-original-content-length: 2511
x-cache-url-1: /images/pearosicon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 1884
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H2 200 kodiicon128.jpg
images.onworks.net/images/ 4 KB
4 KB 94ms
91ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/kodiicon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

81ea22e6310b2238f0c937448a5e8b9f37c3e1aeee273dd3e4a5cff86bf34a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-FOytV9gU7c"
x-original-content-length: 5332
x-cache-url-1: /images/kodiicon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 3734
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H2 200 zorinosicon128.jpg
images.onworks.net/images/ 5 KB
6 KB 97ms
94ms Image
image/jpeg 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.onworks.net/images/zorinosicon128.jpg

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

72826aebfbd36b0946d90411b2eb52e7e54d8b002030abce5ee27dd51eadfacd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: MISS
cache-control: public, max-age=31536000
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-EAcXNQycXi"
x-original-content-length: 7995
x-cache-url-1: /images/zorinosicon128.jpg
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 5453
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/jpeg

GET
H3 200 email-decode.min.js Show response
www.onworks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 13ms
13ms Script
application/javascript 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

x-frame-options: DENY
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"67000b37-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bljw8yP%2BVmWcg4Kv7%2FJ%2BMNoePtp%2FMSPD2BMn0f2WMu9aReLKULx0EOMSZdprNzbfrPKlmBVt%2Fd3BP5JL9%2FQc2bCYYC3Yaely8GBQ2%2BMZBMPWre%2BBrcEsSXjHmfFGMUeO1JK%2FNpLRPXsjkzZrCw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d09157848631811-EWR
expires: Sat, 12 Oct 2024 19:40:44 GMT
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 15:35:19 GMT
server: cloudflare
vary: Accept-Encoding

GET
H3 200 postscribe.min.js Show response
www.onworks.net/ 17 KB
6 KB 38ms
38ms Script
application/x-javascript 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/postscribe.min.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c84c0e919ae72b8ef9abd4d5f8f38bddffd185e571a13c9ab0de6be1391c3c64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"PSA-21EPrDTH8D"
age: 28494
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BFx0PPgP9UIg8WVCyNYb06YkPVGuiEg%2FrO5%2FDJEgzozaR%2F2RV%2BbEfNYIof2cYhku7ae6WZEF55yw%2FClNNCePVmiqpBMJueyIvy2fG33Bijo63FI2DU85mQmXaPbTw%2BVlDeRzL2v52OLxxJAcrA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /postscribe.min.js
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/x-javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d09157848681811-EWR
cross-origin-embedder-policy: unsafe-none
server: cloudflare

GET
H3 200 ad-blocker.js Show response
www.onworks.net/ 112 B
714 B 21ms
20ms Script
application/x-javascript 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/ad-blocker.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7887c0f698d53558fa97c35fee57be8ef4c615a0b26d6d4f0daee6a6228c4bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

content-encoding: br
cf-cache-status: HIT
age: 17947
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Nd3exh7Ridau1bf71w4yRR3ss7Vhye%2Bh%2BN6CGJ7%2BTlQSmKPKBXC7oyWnQGNw1CCqdd619sUkayEb6CQ6TLegk%2Fi%2BR%2FwBw18TSZrOoccklU%2BEQffs1ylTgKcOUgIT1y5bIq0IhFn3R4BZHIVYw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /ad-blocker.js
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/x-javascript
vary: Accept-Encoding, Accept-Encoding
last-modified: Thu, 10 Oct 2024 12:01:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: MISS
cache-control: public, max-age=80000, s-maxage=80000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d091578688d1811-EWR
cross-origin-embedder-policy: unsafe-none
server: cloudflare

GET
H2 200 layout-mobile-2b.css
stream.onworks.net/templates/ja_elastica/css/ 7 KB
2 KB 95ms
93ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/layout-mobile-2b.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

5d74e05640fae0737ed74af2712a68edfaefbd508f6ea29ccb21e95d6680407a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-fwKnWDeaCE"
x-original-content-length: 6944
x-cache-url-1: /templates/ja_elastica/css/layout-mobile-2b.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 1917
date: Thu, 10 Oct 2024 19:36:35 GMT
content-type: text/css
vary: Accept-Encoding

GET
H2 200 layout-tablet-2b.css
stream.onworks.net/templates/ja_elastica/css/ 2 KB
1 KB 94ms
92ms Stylesheet
text/css 2a02:c206:2217:8560::1
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://stream.onworks.net/templates/ja_elastica/css/layout-tablet-2b.css

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:c206:2217:8560::1 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

Software

Resource Hash

cf7a26ecb0b35482b0f35ddd6e28fa91a0b109cf22a5953831c91234251651b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=80000, s-maxage=80000
content-encoding: gzip
cross-origin-opener-policy: unsafe-none
etag: W/"PSA-aj-8STxswNSgw"
x-original-content-length: 3680
x-cache-url-1: /templates/ja_elastica/css/layout-tablet-2b.css
cross-origin-embedder-policy: unsafe-none
accept-ranges: bytes
content-length: 652
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/css
vary: Accept-Encoding

GET
H3 200 getbloa.php Show response
www.onworks.net/push/ 3 B
572 B 211ms
210ms XHR
text/html 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/push/getbloa.php?email=No

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-page-speed: 1.13.35.2-0
cross-origin-opener-policy: unsafe-none
cf-cache-status: DYNAMIC
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=croXLp5Tv4RMF65jJ3ZnnTQDgxNX1PRxh%2FAsVa%2FVmiXdafr1bd0LFE3PXMAj0XLxphUG4g3xJnejKOiJMt%2Fb0mEMX%2B8shiTDZR4D4rCyMxu6FgSkTAokgzucUGEcpHTdYUO%2BBXSfnjq6RRezdw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09157969c01811-EWR
cross-origin-embedder-policy: unsafe-none
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
92 KB 36ms
35ms Script
application/javascript 2607:f8b0:400d:c03::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DN38F0DWYD&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-117545413-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c03::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1d3e256df52d65b37926880c3f18050fe8b81dd398f2d41c534636bec82db89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 93783
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 66ms
21ms Script
text/javascript 2607:f8b0:400d:c09::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-117545413-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::8b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
age: 4330
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 20:28:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 18:28:34 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 5728 Show response
stpd.cloud/tag/ 389 KB
130 KB 212ms
211ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5728
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7abb4854de70e4e697f29a9be068c8d29192e38f4f392fb74a53703e1e5323d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b7c8c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5744 Show response
stpd.cloud/tag/ 390 KB
130 KB 185ms
183ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5744
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a106f7cfe3effdd38dce6866c34102c4f42f9f062c433f7cb28c8c207108f0e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b868c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5732 Show response
stpd.cloud/tag/ 390 KB
130 KB 233ms
232ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5732
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3db2e2d1bd15d8d17abee6356d7f9e1f937e557fd45b47f6a01e7d2a127f615b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b8b8c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5745 Show response
stpd.cloud/tag/ 390 KB
130 KB 238ms
238ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5745
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c39e4d8a13eaa64be410564fe76f74f3e0f832401f579e3f497c38b854266a90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b908c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5729 Show response
stpd.cloud/tag/ 389 KB
130 KB 120ms
120ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5729
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03335d5ee6b1eb3c22bf9b91b35a2d396188a28d52d685284d8c84e7be354ed6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b968c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 5733 Show response
stpd.cloud/tag/ 389 KB
130 KB 234ms
234ms Fetch
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/tag/5733
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1847a7853177bb197438a795b0b8d11c9b1ca76b6b0db356429cef6d5e07db75

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: s-maxage=300
x-stpd-module-cache: HIT
content-encoding: br
cf-ray: 8d09157a1b9b8c72-EWR
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 22ms
21ms Fetch
text/plain 2607:f8b0:400d:c09::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-DN38F0DWYD&gtm=45je4a90v9121000514za200&_p=1728589244366&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685&cid=895941695.1728589245&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1728589244&sct=1&seg=0&dl=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&dt=Session%20management%20for%20OnWorks%20Free%20hosting%20provider%20for%20Linux%20online&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1226
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DN38F0DWYD&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c09::8b Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
304 B 22ms
22ms XHR
text/plain 2607:f8b0:400d:c09::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=560097980&t=pageview&_s=1&dl=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ul=en-us&de=UTF-8&dt=Session%20management%20for%20OnWorks%20Free%20hosting%20provider%20for%20Linux%20online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=783310219&gjid=1222493582&cid=895941695.1728589245&tid=UA-117545413-4&_gid=1322158524.1728589245&_r=1&gtm=457e4a90za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685&jsscut=1&z=215828451

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::8b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.onworks.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:44 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.onworks.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H3 404 getpaypal.php Show response
www.onworks.net/push/ 0
568 B 229ms
228ms XHR
text/html 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/push/getpaypal.php?email=

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=0, no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-page-speed: 1.13.35.2-0
cross-origin-opener-policy: unsafe-none
cf-cache-status: DYNAMIC
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WDi4I4e1y2ynEkqM2xPUuvLPyy71mvqZgyf%2FjvzYyMytRT8HPxou8lR%2BqdnwiV1Pupn5DatLNudCK2GB9DGGYtdqTbvGnbFB9nF%2FiYu%2BqZ0rX0jO%2BWgt1WVcbzFZRrqNNhL2TWPSutIIG4nQeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09157a7af21811-EWR
cross-origin-embedder-policy: unsafe-none
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H3 200 onworkslogofavicon.ico
www.onworks.net/images/ 1 KB
1 KB 20ms
19ms Other
image/x-icon 2606:4700:20::681a:caa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onworks.net/images/onworkslogofavicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:caa , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99bf611b7d8147f4aee55dee27e9bf6c3ba870106206305c464525af5fdca22a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/onworkssession.php

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"625b025e-47e"
age: 28509
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZhawsX%2FqYJ7%2Fjj4mM0phb7bWI2nLH14LkFFdTs6g9QNBdR%2F1G3OxFCF5lSPlNAruSC0D%2BIHzlWjBG3Utd%2Bh12l0TfXqNtFqeecoaJwBZPNAxvizG2go8Dw%2FJUhWK5uFz8uqhPGtjjJWCOvXaxA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache-url-1: /images/onworkslogofavicon.ico
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: image/x-icon
last-modified: Sat, 16 Apr 2022 17:52:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache-status-1: HIT
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: unsafe-none
cf-ray: 8d09157a7af31811-EWR
cross-origin-embedder-policy: unsafe-none
server: cloudflare

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 87F2 105 KB
33 KB 85ms
40ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame C8D6 105 KB
0 28ms
27ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 39F2 105 KB
0 4ms
4ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame 87F2 481 KB
149 KB 67ms
22ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame C8D6 481 KB
0 59ms
58ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame 39F2 481 KB
0 53ms
53ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 98D5 105 KB
0 4ms
4ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame 98D5 481 KB
0 28ms
28ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 846B 105 KB
0 4ms
4ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame 846B 481 KB
0 2ms
2ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 19D0 105 KB
0 4ms
4ms Script
text/javascript 2607:f8b0:400d:c0e::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/stpdwrapper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0e::9a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 825 / 20006 / m202410070101 / config-hash: 9790225331201112668
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33043
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/ Frame 19D0 481 KB
0 1ms
1ms Script
text/javascript 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: 12885551914114104494
age: 4417
x-content-type-options: nosniff
expires: Fri, 10 Oct 2025 18:27:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 18:27:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153016
x-xss-protection: 0
server: cafe

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame B02A 0
0 60ms
22ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 42ms
13ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.onworks.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.onworks.net
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:44 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 181171
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ Frame 846B 42 KB
13 KB 57ms
25ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

5e8020e3d61bfee03a48ca66498521053b0bdcc1a3d8791250ac9bf0f768cbf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"66d98e6d-a677"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:45 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: text/javascript
last-modified: Thu, 05 Sep 2024 10:56:45 GMT
server: nginx

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ Frame 846B 3 KB
4 KB 138ms
10ms Script
text/javascript 2600:9000:20ed:8600:a:e047:754:afe1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:8600:a:e047:754:afe1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1764e898369c24be8d7d1cbcb82079c27f3898fbc1883f388a5c1008dd30c9e8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

x-amz-version-id: 0u1R0tyw.MUCZY63NwBE.7D35dRY5mh8
ETag: "0537d8d06dd9dfbe911ad6bf6504f4bf"
Age: 50114
Connection: keep-alive
Via: 1.1 193d4441ee6d312fd234f2d28e48c110.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 3181
X-Amz-Cf-Id: ZlC3MfFH43EMC5AQFyrwpHFfKZxTVfDFaScL-GJ3ZH-Xghy1kGhVPQ==
Date: Thu, 10 Oct 2024 05:45:32 GMT
Content-Type: text/javascript
Last-Modified: Wed, 31 Jul 2024 16:30:07 GMT
Server: AmazonS3
X-Amz-Cf-Pop: PHL50-C1
x-amz-server-side-encryption: AES256

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ Frame 846B 43 KB
13 KB 79ms
9ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7db46e1255a018ecf02f47b2c19c26c4"
age: 24198
via: 1.1 e8a811941c8b094e985333a44bc18f46.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: pqSLF-A-PH4mGs8HYqu-yHUH9PytTLFRtx-OPQr2x371gYXAA0t1_Q==
date: Thu, 10 Oct 2024 12:57:28 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:40 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ Frame 846B 24 KB
8 KB 63ms
12ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 1526346
x-goog-stored-content-encoding: gzip
expires: Tue, 23 Sep 2025 03:41:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Mon, 23 Sep 2024 03:41:39 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljsUE59Lqx8Pya-mj-IAYuQ6tHN9_f_iQt8ynak5MNVfE4uqkauomXknPwP7mnzcZiugUfo
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ Frame 846B 17 KB
7 KB 75ms
21ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a2ab36c83d5d55e311fbf787dbc7de0a17b89eb0b30b1772f518a79db334001

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66ce3644-43df"
age: 169043
cf-ray: 8d09157d6ffd4301-EWR
expires: Sun, 13 Oct 2024 19:40:45 GMT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/javascript
last-modified: Tue, 27 Aug 2024 20:25:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ Frame 846B 1 KB
1 KB 148ms
103ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e388e19ca38c825b329e762c79c66bbd41bd334f18312c5e97fde0a8f64bca36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

etag: cd19e0900da0cdbc6697310fd9330fb6
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1195
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: text/javascript; charset=utf-8
last-modified: Mon, 05 Feb 2024 22:07:56 GMT
server: Google Frontend
x-cloud-trace-context: 38715b6770bb73cbcf83e308a832ef21

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ Frame 846B 9 KB
9 KB 135ms
8ms Script
application/javascript 2600:9000:24f1:f400:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:f400:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 547
x-cache: Hit from cloudfront
x-amz-cf-id: zdmTuiOGQhXNwNBCoHIW3KlWOwB6lFQEG9C9zYA3d6KT3T7xZAr2yQ==
date: Thu, 10 Oct 2024 19:31:39 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 8cade7b1319c32b4f7e5477c5302d6c8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 846B 15 KB
7 KB 76ms
8ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 846B 2 KB
1 KB 26ms
8ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 846B 167 B
448 B 302ms
92ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame 846B
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=hA012XwweTl3REVXYmV4SFRVbEYyYW1uOTRpRVdEczE3djhhNTFPMUltTHQ0VFJESSt6VGxVZkR0elhWZ3FlRjRvUVVnZzNwdmN6NFNabEVEd0U0MHk4LzdTQzJLYm91L1dGbnVucG4yQ0k2ZDRsYzNXNC9ubUxITituQn...

373 B
935 B

51ms
20ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=hA012XwweTl3REVXYmV4SFRVbEYyYW1uOTRpRVdEczE3djhhNTFPMUltTHQ0VFJESSt6VGxVZkR0elhWZ3FlRjRvUVVnZzNwdmN6NFNabEVEd0U0MHk4LzdTQzJLYm91L1dGbnVucG4yQ0k2ZDRsYzNXNC9ubUxITituQnF1ZHBoT3l1elRrbThiakN1d29SZ3IzdVYwVk9ialA2dzlJWmw1aEtIN21mZHo1cjdoNXVxUW4yQy80ZmRSSmVSczRMZ250V01lVElYK1VDRmpsaWROQ1RhNXZnK25zUU9uek0rU3ZkQm04UXNhcGlpWVhDWnVkLzFOSWtXNGkrNDQ2VVdPMEUwQ3M1ak1HK1BjQTczU2NNZWdPQnp2QT09fA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9888bfd6687c8d9c4ea30b45e0dd34f1619718b5d49c022a655ffae18849301c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 657608
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=hA012XwweTl3REVXYmV4SFRVbEYyYW1uOTRpRVdEczE3djhhNTFPMUltTHQ0VFJESSt6VGxVZkR0elhWZ3FlRjRvUVVnZzNwdmN6NFNabEVEd0U0MHk4LzdTQzJLYm91L1dGbnVucG4yQ0k2ZDRsYzNXNC9ubUxITituQnF1ZHBoT3l1elRrbThiakN1d29SZ3IzdVYwVk9ialA2dzlJWmw1aEtIN21mZHo1cjdoNXVxUW4yQy80ZmRSSmVSczRMZ250V01lVElYK1VDRmpsaWROQ1RhNXZnK25zUU9uek0rU3ZkQm04UXNhcGlpWVhDWnVkLzFOSWtXNGkrNDQ2VVdPMEUwQ3M1ak1HK1BjQTczU2NNZWdPQnp2QT09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 240371
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:44 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 846B 1 KB
1 KB 82ms
19ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Transfer-Encoding: chunked
Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Connection: keep-alive
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bd%2Fgewbk%2BWYmqG69cNm4FGG1FPzonwDphrtTPhRLC%2BMuAXFwtzZuuKfHgAKXIo1bKUSuEjLtqMiWskHd8VrrYBMXwboVYDbEshMunda3OGQsAJtduZpH3I%2FVq3ATf4yh1wfG6xcYT5Lg9A13"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09157df9897d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Content-Type: application/javascript
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame E0BE 0
0 0ms
0ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame C8D6 15 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame C8D6 2 KB
0 0ms
0ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame C8D6 167 B
447 B 221ms
94ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame C8D6
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=OFR7VnwwT2ZabkhTN09DelJrVjZNSUY5alVNaDJQemE1V2I2Mjd2b2loSmYvRkpSbDVNT1RMVFJpaWUybk9sSGhCaUxmcmFjeXZCeXVmQTZzKzdNWWN3VGxoa2Q4OW1uRjRLZXpma3B5SVlGd0YzRldYd051RFVCZUN6N0...

364 B
928 B

43ms
14ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=OFR7VnwwT2ZabkhTN09DelJrVjZNSUY5alVNaDJQemE1V2I2Mjd2b2loSmYvRkpSbDVNT1RMVFJpaWUybk9sSGhCaUxmcmFjeXZCeXVmQTZzKzdNWWN3VGxoa2Q4OW1uRjRLZXpma3B5SVlGd0YzRldYd051RFVCZUN6N0hIeDd4dU04MEUxNHJKVW8wVHp0d1ZjMHhxVG9nSUhTYkNHQURwMFQ2VWFiSVJGVjhCa1g1bVJybkllNExWZkFOUlh0V3hTVDFZZkM3RDdvdks0YU1TUkFYMlJoREhDOEJqenRESEVPdFlvV3drMVRXV1cyaWxUNTJPSktUMVRCUnJPRzdRQ0plNGt3Ymc0N2JKek93ejY2Mno2RysyZz09fA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5170090c12786262fcefb3b3cc01e110e0680001381ffb1f3b1c6a3d4b0d996c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 558269
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=OFR7VnwwT2ZabkhTN09DelJrVjZNSUY5alVNaDJQemE1V2I2Mjd2b2loSmYvRkpSbDVNT1RMVFJpaWUybk9sSGhCaUxmcmFjeXZCeXVmQTZzKzdNWWN3VGxoa2Q4OW1uRjRLZXpma3B5SVlGd0YzRldYd051RFVCZUN6N0hIeDd4dU04MEUxNHJKVW8wVHp0d1ZjMHhxVG9nSUhTYkNHQURwMFQ2VWFiSVJGVjhCa1g1bVJybkllNExWZkFOUlh0V3hTVDFZZkM3RDdvdks0YU1TUkFYMlJoREhDOEJqenRESEVPdFlvV3drMVRXV1cyaWxUNTJPSktUMVRCUnJPRzdRQ0plNGt3Ymc0N2JKek93ejY2Mno2RysyZz09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 306944
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:44 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame C8D6 1 KB
658 B 20ms
19ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9aV%2FmB1e02f3Ozzh4tMIIA4aUpuQaDAK0ffbKWPWCV9olii3RMHaLevAs0Ayy8idAyjzUuHATDOAMn6pfgi39%2FJp68fjU4VBBSsCofI%2Bu3Zz7wKT1yg2CQJp4ZFYxzv8UzlPU1PWuOMReif"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09157e19b37d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 242B 0
0 0ms
0ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 39F2 15 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 39F2 2 KB
0 0ms
0ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 39F2 167 B
447 B 132ms
95ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame 39F2
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=NyNLJHxKdHNOQlFCS1AwdlZOalRISkV1VzV3UUpsZFNKKytyVjl3ckdXRGxKYzBWanQ1cmNQL2c4a3lDaUJONTFjQ0Fac1B4RDRxUDZNSjlpVjBwOXNDaWczN1ppR0tKdktnNVlUM1c0TkhlaDk5TzVRaEU1UXRBdnBsTH...

359 B
929 B

43ms
15ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=NyNLJHxKdHNOQlFCS1AwdlZOalRISkV1VzV3UUpsZFNKKytyVjl3ckdXRGxKYzBWanQ1cmNQL2c4a3lDaUJONTFjQ0Fac1B4RDRxUDZNSjlpVjBwOXNDaWczN1ppR0tKdktnNVlUM1c0TkhlaDk5TzVRaEU1UXRBdnBsTHdzM0tKMFBDcWJ6b2lJVHVFbG96YjdHMjZpbkpsZ3Q3NmlXc3ZZSVhzc0hHVFR4SjVkRWhTTUZBZzZCckRMUTRXUmlRbGw1T2hmTlZXeHdCOVpiV29LaGV2Q3N0Z3pJZkpyMWVIVi9qVVlMY0crNUZTM0NKb3FzSS9YeTloSjJ6ZHJHZkUydHRhfA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

80d07a03538fea0f39a9c73ae98ce4edd37c68db5dc4dfdd601b1556ab94bb6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 578821
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=NyNLJHxKdHNOQlFCS1AwdlZOalRISkV1VzV3UUpsZFNKKytyVjl3ckdXRGxKYzBWanQ1cmNQL2c4a3lDaUJONTFjQ0Fac1B4RDRxUDZNSjlpVjBwOXNDaWczN1ppR0tKdktnNVlUM1c0TkhlaDk5TzVRaEU1UXRBdnBsTHdzM0tKMFBDcWJ6b2lJVHVFbG96YjdHMjZpbkpsZ3Q3NmlXc3ZZSVhzc0hHVFR4SjVkRWhTTUZBZzZCckRMUTRXUmlRbGw1T2hmTlZXeHdCOVpiV29LaGV2Q3N0Z3pJZkpyMWVIVi9qVVlMY0crNUZTM0NKb3FzSS9YeTloSjJ6ZHJHZkUydHRhfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 263176
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:44 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 39F2 1 KB
658 B 16ms
16ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8BqIOSRlop4ryTqOWyPS8jTCb5xjKAX8Qwx60nm0WOPY7ps%2BLEqt0TKCLF9VKDHEJaJDEo1A8B6NeCw1%2FzUj6AW8TX215AZZZBCzLsSf4SvDseUeHoCB0etIi3O5U71jUEV%2BNKGKHsih5g57"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09157eaa647d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame A858 0
0 0ms
0ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 87F2 15 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 87F2 2 KB
0 0ms
0ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 87F2 167 B
447 B 93ms
91ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame 87F2
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=sTeJpXx2WVU3WlFaZjM5ZzJIclNyUmRRaFJzbmtwZ1RMUDdXZTd6emZJWllldlZIR0JTczFpTHNiSE5VVUFGRUJ4QnJERXBZY0JtMlQ2dDFGY2dCN0FpNFVTSjM0djM3VTI0emhlTTZCTzZ3ZVBjSTVxdlJ1a2w4T0llMm...

359 B
937 B

48ms
20ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=sTeJpXx2WVU3WlFaZjM5ZzJIclNyUmRRaFJzbmtwZ1RMUDdXZTd6emZJWllldlZIR0JTczFpTHNiSE5VVUFGRUJ4QnJERXBZY0JtMlQ2dDFGY2dCN0FpNFVTSjM0djM3VTI0emhlTTZCTzZ3ZVBjSTVxdlJ1a2w4T0llMmJWUWlYR1A4SE1VOUVoSDdwRS9jamRTeWN3Rm1nMjhXVkxFWGdSUjh1VytFNG5JYUZkYzRSbS9sc05ObFFmdXk5cHN0dkdEa3BKSU1tOGRzVEVrUjBKeG5lOEs1NURpeUMrUW9wN2FjWlEwd21rZlUwY2I4UkxyOXJHTXFIMUNnWHpPcGFkZlVGMTJPV3VBQ0JDbTQ3azBaWVgwekNVUT09fA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

158bdeda69bcdd820b26b9f7c55a42af2b1985d8d0021c30ad914f253f7c26ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 561579
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=sTeJpXx2WVU3WlFaZjM5ZzJIclNyUmRRaFJzbmtwZ1RMUDdXZTd6emZJWllldlZIR0JTczFpTHNiSE5VVUFGRUJ4QnJERXBZY0JtMlQ2dDFGY2dCN0FpNFVTSjM0djM3VTI0emhlTTZCTzZ3ZVBjSTVxdlJ1a2w4T0llMmJWUWlYR1A4SE1VOUVoSDdwRS9jamRTeWN3Rm1nMjhXVkxFWGdSUjh1VytFNG5JYUZkYzRSbS9sc05ObFFmdXk5cHN0dkdEa3BKSU1tOGRzVEVrUjBKeG5lOEs1NURpeUMrUW9wN2FjWlEwd21rZlUwY2I4UkxyOXJHTXFIMUNnWHpPcGFkZlVGMTJPV3VBQ0JDbTQ3azBaWVgwekNVUT09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 260926
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:44 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 87F2 1 KB
664 B 18ms
18ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G8q7fwB%2FLrFoe7%2FDoWZHO6fP2HUL%2FUKRbmJ5sUrSTL%2F8ChJmn8wVu5xWobCZcoxzvdYxq75zIXffgZfxkXvCzixoA0OQLRBxxu38ac6W%2BJO4%2F3SlM4qMyasZIc2rYmJfIpHRQH9oALSPzy2s"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09157f3b437d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame B496 0
0 0ms
0ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 98D5 15 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 98D5 2 KB
0 0ms
0ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 98D5 167 B
447 B 94ms
92ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame 98D5
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=R_tg23xkNGtPa0Q3alJRWkhNZzJVVlEzbit6UW9senh2VmZPa2tQZldpZjM4c1hYUFNBSWxyZFZpd3MwaUNKbGM4cnRORGxYNWwrZ00wRVo2THh1VnFrSlIvaEhsaVJOMENVOVZaZmNiVDJYMWhoNDBaQ0FmbmtaOGNrcC...

359 B
933 B

42ms
14ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=R_tg23xkNGtPa0Q3alJRWkhNZzJVVlEzbit6UW9senh2VmZPa2tQZldpZjM4c1hYUFNBSWxyZFZpd3MwaUNKbGM4cnRORGxYNWwrZ00wRVo2THh1VnFrSlIvaEhsaVJOMENVOVZaZmNiVDJYMWhoNDBaQ0FmbmtaOGNrcCtMclptUExUb3Z2ekwzb29UWExlZ1BHVWI4cGtEMEdBcTNwU052MFpOemQ1cFJ0ZFhFZXpnQk9YRllIVkd1elMveGZJdXZnTTVIZGtIdmp1SE9RWWpIT0h3Q0hFTU5nOWNkbGZEVFBsVnRkMUR4cXhUN0k3MitPN0hXUnVuaHJmRWc0TUt3WFdlTStZYzZDYldYRHpXV2JwMDV2MU40UT09fA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

de502ef16a7f705e8eff5b8ed0a82ab04ee8674eb4dfab14f8d2d310956df60b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 437859
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=R_tg23xkNGtPa0Q3alJRWkhNZzJVVlEzbit6UW9senh2VmZPa2tQZldpZjM4c1hYUFNBSWxyZFZpd3MwaUNKbGM4cnRORGxYNWwrZ00wRVo2THh1VnFrSlIvaEhsaVJOMENVOVZaZmNiVDJYMWhoNDBaQ0FmbmtaOGNrcCtMclptUExUb3Z2ekwzb29UWExlZ1BHVWI4cGtEMEdBcTNwU052MFpOemQ1cFJ0ZFhFZXpnQk9YRllIVkd1elMveGZJdXZnTTVIZGtIdmp1SE9RWWpIT0h3Q0hFTU5nOWNkbGZEVFBsVnRkMUR4cXhUN0k3MitPN0hXUnVuaHJmRWc0TUt3WFdlTStZYzZDYldYRHpXV2JwMDV2MU40UT09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 314758
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:44 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 98D5 1 KB
654 B 21ms
21ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e5QUFmG82Vj8eSk6pLJEuvcE9HwjOnsMK6nULUksoew6VSNJiMdcQ1NQB4jKC8VyGmLf5T%2B4DFrsNGc1ZO7RXFAo5PSQvPsD8QOW7MayXuutpDHkkhlDbXO5vchrktteQWkFVVJnwwsR2f8N"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09157fbc1f7d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame EDC6 0
0 0ms
0ms Document
text/html 2607:f8b0:400d:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 371
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29509
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:34:34 GMT
expires: Thu, 10 Oct 2024 20:24:34 GMT
last-modified: Mon, 07 Oct 2024 19:46:42 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 op.js Show response
tagan.adlightning.com/setupad/ Frame 19D0 15 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/op.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-amz-version-id: 6zoIdCn3VRcHytaqSceCHGb03R7_Sbv_
etag: "7d54a2fa2cd53782daf4f78b00a95939"
age: 2766
x-cache: Hit from cloudfront
x-amz-cf-id: LGT_3Fc8bHEDtlrWvUrmqthVObLEAyqstrklUWef6txRGKLQsbMGFQ==
date: Thu, 10 Oct 2024 18:54:40 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 09 Oct 2024 13:45:37 GMT
cache-control: max-age=3600
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 6581
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 19D0 2 KB
0 0ms
0ms Fetch
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20241010

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"63d-JY5EHt0zOO+RfkFLHBQvHU1wHzQ"
age: 13190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21986-LGA
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 835
x-jsd-version: 1.0.2205

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 19D0 167 B
447 B 94ms
92ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame 19D0
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.onworks.net%2F&domain=www.onworks.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=OiRk4Xx5dU9yaitPMEpqdG1yQlg3OGJyRCtEZ0Z5a3B3NVRmTUtpbTc4bCs0bDhmZFQwL3p3UGNKVU9iUWUvVWs3dkFlYU1QWk1YY0Zzd0lmazdsd09rMlBiQXlEWFJrNjUrVm5DdzdPcEUwbGdjSFpGVkpHd2QvaUh3Zl...

356 B
924 B

19ms
16ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=OiRk4Xx5dU9yaitPMEpqdG1yQlg3OGJyRCtEZ0Z5a3B3NVRmTUtpbTc4bCs0bDhmZFQwL3p3UGNKVU9iUWUvVWs3dkFlYU1QWk1YY0Zzd0lmazdsd09rMlBiQXlEWFJrNjUrVm5DdzdPcEUwbGdjSFpGVkpHd2QvaUh3Zlp1VS9NN0g4eWVRbG1QUEFpT1lGd1N5bTN6a2Q1b1JnUnVPenhyVWJuRkdMVHhxeUtLZUh0ODFxZSsvaDJxZTRhL2JUOFcwblZWZ0puUE1NWDZqQVhEVktyR2pLYWdJNkRyUVFNUlpGdjYwVWRYKzVOOHFTL0ZjU2VLVzBYbnFoV3pJMStGbklUfA&cppv=2

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f1143f9e51664becbfc711a82aabd0b1c8dd800c150e7cdcc259f9bb98312fd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 501883
expires: 0
access-control-allow-origin: null
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=OiRk4Xx5dU9yaitPMEpqdG1yQlg3OGJyRCtEZ0Z5a3B3NVRmTUtpbTc4bCs0bDhmZFQwL3p3UGNKVU9iUWUvVWs3dkFlYU1QWk1YY0Zzd0lmazdsd09rMlBiQXlEWFJrNjUrVm5DdzdPcEUwbGdjSFpGVkpHd2QvaUh3Zlp1VS9NN0g4eWVRbG1QUEFpT1lGd1N5bTN6a2Q1b1JnUnVPenhyVWJuRkdMVHhxeUtLZUh0ODFxZSsvaDJxZTRhL2JUOFcwblZWZ0puUE1NWDZqQVhEVktyR2pLYWdJNkRyUVFNUlpGdjYwVWRYKzVOOHFTL0ZjU2VLVzBYbnFoV3pJMStGbklUfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 260107
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 0
date: Thu, 10 Oct 2024 19:40:45 GMT
server: Kestrel

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 19D0 1 KB
664 B 21ms
21ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"00a8e13a83b2bbab51af8e55f52be363"
Age: 650485
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MgmTRrD641wIgBJZKAHTghpav63MZUE95x9T%2FLqfUMh7cwtZooNWg9xy6g2mmGXVvh9ft6xMjfinV%2FlxxU0%2BP9w8bF8PeuDthYBACKpKw3%2BurENfM40txqDrDk6T05KQalnuF5ly%2FtqP%2FKzx"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d0915807d1f7d16-EWR
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:32 GMT
Vary: Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 846B 1 KB
720 B 397ms
212ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e5990d1ca2c462aa4bd70179996d8fb166050868c3f41ed77823c78be19079a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8DA2xIqBgNBD9C34B%2FNQ3PTn02gKBDFaKNTS1cdXFn%2FJUtd1%2BzrIWO4iXy5G265hRUG88X3VPanWgVVu2cyq7i7GmMUK%2BFQUnQZugCdEvRQWtYvM8GpeMZRhMrj6HnQq88YAbn9qgLQ9"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de3e1a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 846B 446 B
750 B 479ms
432ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f1582134128745f50ee71dc17905d537c6492c26347a6635a837b84d957057a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBW6nHCl7GMmUbnjGRKB6rp%2BzAprwg5AqvxIjCFgPZDIUmEPgwQfzVFghPOoXGVBwGuS0nOE%2BxhM%2FyjW2arxsMyRLA30Bd8%2Fw9DH9UgMYKJXix1dmvlRqzBEMsGS6K1JjEsbOm0UZ5Rr"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de491a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
x-prebid: pbs-go/0.259.0
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 846B 1 KB
1 KB 88ms
45ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: bb4f293b5cba0602b0e0e1ace023aecea4e459131ba9f076b9a74434e625e095

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 27
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 505
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame 846B 0
531 B 734ms
323ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 846B 0
177 B 379ms
168ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 846B 1023 B
2 KB 297ms
197ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: 0a4146becb1be37a2acf0f521fd3ae9fc2ac389542286c64900e67effdf572ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame 846B 83 B
627 B 172ms
21ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: af6077192f7a5e015bd8f1206acb1fc8b1fa35d5116ffe208fbc614dbfa09e21

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: fcGP58CtcWG-2XkfHnCfnwtpZn0u2dlKDI0MoVWgNDnEPKHwLX-RSw==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 846B 19 B
1 KB 206ms
139ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 846B 13 KB
7 KB 379ms
304ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

ac6269919d4b13a28e2e95dcfadc1fa92ce58e406d22f4fed3bb4a0d8a378af1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: 764e6a8c-969c-4e88-a550-9c42f081f921
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: nginx/1.23.4

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame 846B 0
214 B 140ms
38ms Fetch 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
server: nginx

POST
H2 204 prebid Show response
mp.4dex.io/ Frame 846B 0
491 B 345ms
247ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d12de93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 846B 0
505 B 352ms
295ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=86866460730&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
server: Kestrel

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame 846B 2 KB
2 KB 314ms
84ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: d5b37b5a1c3dc069175225777a952f7ab33cd5415812e2b72910aae07392b609

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 1961
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame C8D6 1 KB
712 B 363ms
213ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95d29d8e3a8df165fab43d84e47fe4e57c95421caaa9509a6ed2c4fedbc34985

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mTd6MQnuRNM2QgCujGGe7YJqPKmtPm5VA0OzgeWRNiTwYqSGcx4kaW8VTkOwiyx4oMzGQU8H8mPfsdFFC08zqPWX2DNbbLFp1kIn0Saj20ypEacuzns11%2BTCAjlHg3aAEyvaCa3w%2BBJA"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de451a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST auction
prebid-stag.setupad.net/openrtb2/ Frame C8D6 0
0

POST
H2 204 prebid Show response
mp.4dex.io/ Frame C8D6 0
274 B 544ms
446ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d14de93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame C8D6 0
531 B 576ms
175ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame C8D6 1 KB
1 KB 104ms
70ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: 1fc1571d6833cc5580555dfcec814405cb7bf33eea36f0dda5d43e0a95ba9b01

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 36
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 505
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame C8D6 0
177 B 371ms
169ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame C8D6 1 KB
2 KB 315ms
224ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: 7262d54274ef0304ad875831934e874d1d148686d9f8e3646810113f23ec12af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame C8D6 0
214 B 145ms
51ms Fetch 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame C8D6 19 B
1 KB 198ms
133ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame C8D6 2 KB
2 KB 309ms
85ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: bc4f319e08261c2f81bb1f96c1f674fd4a60924954dcc0376dfe57d01aa6bd73

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 2011
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame C8D6 83 B
626 B 172ms
30ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: cd2e6effa8aef92397803fee376f460bf05870e2cdcf10b8cf1dadd45699f97a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: RJ1tjQ0b-oxMUcV1b1p5F72_tSxc8WdbcibcrknNCTKBFjllqk-kMA==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame C8D6 145 B
1 KB 483ms
417ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31fd78934db81217de98d6d2ea6686f40e9057c4a873d53a4d295f9996dc7cbd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: 82eb0919-ebce-4605-ba32-9828ad4bebb2
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame C8D6 0
493 B 182ms
132ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=68335480382&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:44 GMT
vary: Origin
server: Kestrel

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 39F2 1 KB
1 KB 315ms
201ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f53d180bc6394965a32e6bd8ddfd05d8bf69ae8239614e8cffa6b83e9b1ee90b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ve9G1PE5S9nMuMIYHfXxgnlnFo6mMy%2BGq1ODZonHIdQcnmEULTspBgz9IV00tInOFSuqISb1hT1RoCht0boph%2FLL6pDhE42k8TlAZOSsX6t6FQbentzNa6rOHqwGKeGs6GAff0ZGRw02"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de471a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 39F2 443 B
596 B 371ms
325ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bf15e61162bfc4ffefed3fbd18f21533f76a714ccc7b689e5eaa1a6763daa9a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fz6UWaVyiIbGbk8%2F3eiDZx2A%2FFc1fC89Qd86t6CVCFvooef14gXIz2sDxz8JXBXbpA4m36oCvV4Mi99BmLp%2Fzu3nW20Ji7tu7ieH%2BTcYtaO9c1Dqo06QCahlPr6AKkG0sAy2T0V9s4hZ"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de4e1a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
x-prebid: pbs-go/0.259.0
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame 39F2 192 B
442 B 130ms
38ms Fetch
application/json 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: 905c4ef33160a29cd7957ce9fa7f0a89baad1dc831f35920c147a6159619f285

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 192
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
server: nginx

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 39F2 0
177 B 376ms
178ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 39F2 138 B
826 B 164ms
98ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

382ae2ac9972307a8053b779883c2c6764e7a4c30648ed4e315653a8a0b7fb9b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: e52ef7b3-1cd1-4d02-9c3c-e73efe2ae9ca
content-length: 138
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:45 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 39F2 989 B
2 KB 342ms
254ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: 3b5fbc8c60678327860e3c17852c1e9b75060ab03d9e82a73028cee5f181bf61

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 204 prebid Show response
mp.4dex.io/ Frame 39F2 0
274 B 451ms
361ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d15de93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame 39F2 83 B
627 B 161ms
21ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: d9a0694dd3537836a960a472a5ba8a4fe9a4ccdc95dc2eb4864c7d828e1996ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: o4cgQlAOaulJAmUIUSC9RR2fjoZ2NFyxpNnPk8zP_9dy2ZkMyzmP4w==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame 39F2 2 KB
2 KB 306ms
84ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 5c44c3e0ae02211d4c81a933e5f1c04c27e7925ccb45ea8d478da62555aeaa71

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 2011
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame 39F2 0
531 B 688ms
291ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 39F2 0
500 B 276ms
229ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=53184021176&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
server: Kestrel

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 39F2 19 B
1 KB 226ms
164ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 39F2 1 KB
1 KB 145ms
117ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: 639ff68a2385af8033b2211dcdf847b85f34b87f13d09eec01ee2fd02a21712d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 86
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 505
date: Thu, 10 Oct 2024 19:40:44 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 87F2 1 KB
829 B 363ms
289ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6693bc43d302407eab5cc78d16e4cebc402e3cc1b5e185a05524ac3caab84054

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ripUMCHuWBI9E%2BECPhd8BBizCord40H83uatIkbXGJ%2ByN3e%2BK4G%2BFTJJ61VBzA6R2GQ6d9fhI%2FKNp3Na76mFlVSWQ%2BJ55hXUC6tBc81lF21hCfI2I1pISB1vr8ZG0rcdDfeD%2FMNqcJs"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de481a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 87F2 444 B
567 B 436ms
391ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43aa1bc1ee9c2d20f7b759bacdc554c8f0587006fb3ad5b245946bc94bd77cd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQyOrGJZAlzHHsNkks4Se5ZuTDLD6HraLGJdeWojKF8bISvq2E8dW%2F0i1iN%2Byj58MDFc7FiDskk9XBn4iUK9cfycRQDPit67X%2BE2o7o7PFGvqO%2Ban513VDWaK6qlwImRez1xCWocfDk3"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de4f1a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
x-prebid: pbs-go/0.259.0
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 87F2 0
177 B 284ms
89ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 87F2 145 B
1 KB 296ms
235ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

b1c2bd2fce91d330787c720e5d8bd1ad8cd01b2f274427450ae30c9341921418

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: 416703fc-1938-4a45-988b-167827bb34cc
content-length: 145
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 87F2 902 B
2 KB 310ms
225ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: a0262d941852436e97f598c5dda0907b2ec3c22d57eba5c6280b4d3dd931fca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame 87F2 0
532 B 551ms
159ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame 87F2 0
215 B 120ms
33ms Fetch 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
server: nginx

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 87F2 1 KB
1 KB 70ms
43ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: de639f84f1d5b343cdf081027bec97d003b080eada14a038fb5e25b70502f3c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 11
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 505
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 87F2 19 B
1 KB 177ms
125ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame 87F2 2 KB
2 KB 303ms
87ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 1f55bcced5aba87a1628aaf5a33cea862e5f91501ee7e5e8bbd3d92aaa4487ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 1961
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 204 prebid Show response
mp.4dex.io/ Frame 87F2 0
273 B 363ms
280ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d0ade93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame 87F2 83 B
629 B 150ms
18ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 194cd3ea6e7f8309628ecd20e923e2aa42a6b33ec48239e0532e38559877fdcd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: ZSAtZxSSJF6D86SGQWJUyK7t1F486CyRTqJox7AIGOVHlVQ5ti6jBg==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 87F2 0
489 B 242ms
201ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=92107921782&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
server: Kestrel

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 98D5 1 KB
702 B 370ms
336ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a08376248bf75fc5ca4cac80799d1aa3590dd1b23c5f0aa1d9c2f6eb11e63dec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Bkij0WyVMXtSUmFPMfBQyzIvtK9XflLDF2hHFsJhii7QtoB5OohUk36Z27CNcY3ueSgg3oreBK7rUXlpo3EZlVC%2FD1UyoNAavEa%2F%2BTiTK0vRxolk47Jqj8QHRdH1Xujx9hCbIhLpUk2"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581de501a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 98D5 443 B
571 B 378ms
366ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22980332555c7be92667fb0a19debdfaae56e965892c85b701fd5fe1eb206ade

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XQphtQbdBFTyu%2FEVeOsSdwjilnzPzgu%2F9fcnwHNJTWJB3utiSYPl%2Betl6d4TKiGDODWYTwGxBQnKUtcGz6S%2BOpJKRugZ7RDSwMw56EvtYgwgzCVXtAa10b8rkYZ4scYMyWtswpk04X75"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091581ee5e1a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
x-prebid: pbs-go/0.259.0
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 98D5 0
178 B 276ms
89ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 98D5 967 B
2 KB 333ms
257ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: e3c43be28112e056edd890214701ac10989800762cf74f55aafd84d622ad61f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame 98D5 191 B
441 B 113ms
34ms Fetch
application/json 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: c348cc05c0eb84eaf0e4b919ceb9515e08d5b4f10cca04b98149e1ea804c4b1d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
content-length: 191
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
server: nginx

POST
H2 204 prebid Show response
mp.4dex.io/ Frame 98D5 0
274 B 452ms
374ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d10de93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame 98D5 83 B
627 B 161ms
34ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 89f708f6ac0380dc8e47eef4a20294534850a3925d0ef6defa9a87d636b6a549

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 12
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: zCeaj75jAfUq2Kmqcrx99MLh3rvK4Ky22LRTRbElc8i_Vby-Pxe0lQ==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 98D5 19 B
1 KB 167ms
123ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 98D5 1 KB
1 KB 114ms
96ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: b0d64e2593aa877b342b630ee9f4cab511fc5bc79c09d63c4af448a50e5d63fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 61
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 506
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame 98D5 2 KB
2 KB 297ms
87ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: e9977e6290d6eb46a428fd34df0065423b48ffc3bc9a7767138eee523df70a32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 2011
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 98D5 139 B
829 B 69ms
17ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

40fdf5c404861d6180ee4a7ece01b3037b475aa37f7c259c7702e90cbfcf3623

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: 24924df1-fd74-4c96-a49f-a3fe3098e11b
content-length: 139
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:45 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 98D5 0
492 B 271ms
235ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=64840026636&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
server: Kestrel

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame 98D5 0
531 B 679ms
296ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 95ms
25ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:44 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 173246
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 94ms
25ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 156914
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 57ms
29ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 225734
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 57ms
29ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 183784
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ Frame 19D0 1 KB
711 B 210ms
203ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 883dccb8109024ae995673839e1c01e65065c94edd01d121a0deea14830b255f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KV8HsfRgjSePuW3O25Mp2cC3S0gXCvjd3fw6VYXoh%2BQt0uvticXF0ha2KdiGWPQJc5WgQtsmNWc5G09TZU%2BSX2QeR5nfVoyoM%2Fyi8sFCX7yc9mOSIC%2FjzLcDiuEZWYuzB1hAX8Br2L2e"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d0915820e861a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: cloudflare

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ Frame 19D0 447 B
567 B 741ms
734ms Fetch
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 770ad859a362b5fbc8ad7a6ca102df4ed0630140d62282d405c22e73576d0cb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yTWQyF6BIS0n%2FkWF6ABn%2FiCgpaF5Owh0%2FGMEPvBa5zc3rkUi9LFbIPAUtYiHFX6qLAg08jgZ4vhLjl8UOwCgHkR00uDe3U5EYhZjW6h1blmcu4sxnrnwaJ0l4AZdC%2F25V4k9V7V6ifSL"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d0915820e8b1a44-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
x-prebid: pbs-go/0.259.0
content-type: application/json
vary: Origin
server: cloudflare

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ Frame 19D0 0
214 B 100ms
52ms Fetch 2606:ae80:1471:12::500
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:12::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
server: nginx

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 19D0 0
177 B 323ms
170ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, CY),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ Frame 19D0 2 KB
2 KB 264ms
86ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 4a5fb637292a28d7bb57ca7bbce22fbb12d283d3d0ab3aaeb59fcae0a96e0713

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: 0
Access-Control-Allow-Origin: https://www.onworks.net
Content-Length: 2011
Date: Thu, 10 Oct 2024 19:40:45 GMT
X-Prebid: pbs-go/unknown
Content-Type: application/json
Vary: Origin
Server: nginx

POST
H2 204 prebid Show response
mp.4dex.io/ Frame 19D0 0
273 B 387ms
340ms Fetch 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

x-version: 3.0.0-gcp-las
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
x-err: Calling bidders. no bid responses
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 8d0915825d19de93-EWR
expires: 0
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ Frame 19D0 83 B
628 B 125ms
33ms Fetch
application/json 18.164.124.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-86.jfk50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 3b9055de4b7d6dd982c32df2f5e3ffb4bb9e205a23adf70f2d57db9a20d6e04a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 12
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2ea9039b9f2f8786d91875568c2764d6.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.onworks.net
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: eejkBtINISlBg2B3dIhcf7-VVF1IqycGtuPLgaQyzY5J6yTAVvz9_w==
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P7
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 19D0 13 KB
6 KB 212ms
199ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

712813ea22ce01143e99b9ddd631d7139fdbc557f0ec914740a976e1f0494022

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.onworks.net
an-x-request-uuid: 6f2c749c-5dbf-4a3f-b48f-d48f6c3c399e
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:45 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: nginx/1.23.4

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 19D0 925 B
2 KB 388ms
333ms Fetch
application/json 147.135.119.115
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.119.115 , United States, ASN16276 (OVH, FR),
Reverse DNS: ip115.ip-147-135-119.us
Software: /
Resource Hash: 7322aee0de286cc14286157403e0a3b7943a1f62347e8f55ffc0190d70b0b669

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 19D0 19 B
1 KB 127ms
118ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.27.0&referrer=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&tmax=1000

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory
access-control-allow-credentials: true
observe-browsing-topics: ?1
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 204 openrtb Show response
adx2.adform.net/adx/ Frame 19D0 0
531 B 632ms
291ms Fetch 185.167.164.52
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx2.adform.net/adx/openrtb

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
expires: -1
access-control-allow-origin: https://www.onworks.net
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 10 Oct 2024 19:40:46 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

POST
H2 200 c Show response
prebid.a-mo.net/a/ Frame 19D0 1 KB
1 KB 43ms
39ms Fetch
application/json 125.253.89.178
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.178 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: 1599a3b672ef5fd9937e1d3e8d6ec5051dfbdf10f96d155381602bcb05139658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 19
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 506
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 19D0 0
500 B 127ms
124ms Fetch 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.27.0&cb=62736422692&lsavail=1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
vary: Origin
server: Kestrel

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 52ms
26ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 176241
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 syncframe
gum.criteo.com/ Frame 48C8 0
0 59ms
15ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.onworks.net

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:45 GMT
server: Kestrel
server-processing-duration-in-ticks: 357158
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame C8D6 68 KB
26 KB 25ms
16ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame C8D6 182 KB
65 KB 25ms
17ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame 39F2 68 KB
0 16ms
16ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame 39F2 182 KB
0 16ms
16ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame 87F2 68 KB
0 8ms
8ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame 87F2 182 KB
0 8ms
8ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame 98D5 68 KB
0 2ms
2ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame 98D5 182 KB
0 3ms
2ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 25ms
23ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 10 Oct 2024 19:40:45 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 196348
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame 19D0 68 KB
0 3ms
3ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame 19D0 182 KB
0 1ms
1ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2

200

esp Show response
oajs.openx.net/ Frame 846B
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp&cc=1

85 B
194 B

40ms
37ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp&cc=1
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: e2929281ec2f47f3b6f20549313374c66f14731a21cefb0b7f544491bdcb64b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

etag: W/"55-ocnuUj4UBiXF6XIlLBB/TWMC9QA"
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.onworks.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json; charset=utf-8
x-powered-by: Express
vary: Origin

Redirect headers

location: /esp?url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&rid=esp&cc=1
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.onworks.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 10 Oct 2024 19:40:45 GMT
x-powered-by: Express
vary: Origin

GET
H2 400 fed Show response
ups.analytics.yahoo.com/ups/58813/ Frame 846B 0
364 B 103ms
17ms XHR
application/json 3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

ATS/9.1.10.137 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json
vary: Origin
server: ATS/9.1.10.137

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame 846B 68 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bl-86ffba5-9322e4ad.js Show response
tagan.adlightning.com/setupad/ Frame 846B 182 KB
0 2ms
2ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/bl-86ffba5-9322e4ad.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "d7ba6a9594c5cbc618b6e52030ce8049"
x-amz-version-id: sEsN57CLx.h4pQdaCTQ3rglcxbh0MflY
age: 107225
x-cache: Hit from cloudfront
x-amz-cf-id: PVcSHzJxuCYUinF3yjJeXc2RaVc_xs0YDqzL_G7RGz9q6C9tfuoY3g==
date: Wed, 09 Oct 2024 13:53:41 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:45:24 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 66151
x-amz-meta-git_commit: 86ffba5
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 846B 45 B
287 B 286ms
87ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

8de8824661201446be346fee8ad5d5e085018eab63187bdc64f23c9a48b61b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 script.js Show response
cadmus.script.ac/dahhc4ozyvjm6/ 3 B
239 B 49ms
18ms Script
application/javascript 2606:4700::6812:1791
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cadmus.script.ac/dahhc4ozyvjm6/script.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1791 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 101ead936a2281d53dcc064b7e2a2ab0d53b92ef3ef7b34b668673007895c860

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public,max-age=259200,stale-while-revalidate=86400,stale-if-error=259200
etag: W/"601055f6a0c6408859f97b5f0a84bdb88441a80e"
age: 0
cf-ray: 8d0915831c044362-EWR
content-length: 3
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Mon, 01 Jan 2018 00:00:00 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame 846B 61 KB
19 KB 50ms
28ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050074
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LR02IB16BmwpKFAmSO34ZXJddNCXWf1I0epHH%2BXsFjz10UyRsTUpO3ekdozxR0y85Il1bWul6K7MllEwHgK27SOpiC5xPm6Sk8kjQyq1tJuu3tUy7EfyCAQGWGoK5ks0%2BPXdKsQCY42k%2BUCP"}],"group":"cf-nel","max_age":604800}
Date: Thu, 10 Oct 2024 19:40:45 GMT
Content-Type: application/javascript
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Transfer-Encoding: chunked
Cache-Control: public, max-age=1800
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
CF-RAY: 8d09158319594350-EWR
Access-Control-Allow-Origin: *
Server: cloudflare

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame C8D6 45 B
286 B 371ms
89ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

259a116d793a035373e51dea42ed61220bae40bcf46e7811b017ce35dbb686fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame C8D6 61 KB
738 B 83ms
28ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050074
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hSbqvtj%2BgffFYXME5UKRbLXNM7LjMS5yD1fzcvxVkzxDfCxyYC7k4iCMNPx39FdPJ%2BhNZf%2F9BE%2FJIQjNXvUIpSDJ0%2Bbwqpf%2FSq4V9mGru5wGqaN9hh1ERZW7r2WOf9UKXR3BGaZCrUSky37F"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d09158349b24350-EWR
Access-Control-Allow-Origin: *
Date: Thu, 10 Oct 2024 19:40:45 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 39F2 45 B
286 B 458ms
88ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

d3b2e215aa16c508ff50b076b82584ab9c2a86e52066d1fa12dceff1d1694437

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame 39F2 61 KB
738 B 103ms
21ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050075
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HtD16Jd%2BV9wDEXMfJpRwlVgtksTfkhqYy%2BqHM4pKnwEHXCFA3fcTm5cv8BOS%2B%2Bqq2gdkHwhrj70%2F1lq9RRirFAy5ZQFZCUD4MMv1We8%2BVu5sraYyDiKVnSAXNPs492hzBu6YZDTP6ic7eXh5"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d0915837a0a4350-EWR
Access-Control-Allow-Origin: *
Date: Thu, 10 Oct 2024 19:40:46 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 87F2 45 B
286 B 546ms
87ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

fac4c154d1bc897080c1de943b29bf9fd8ae2c4b0849ce4bb97d571d07124d10

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame 87F2 61 KB
732 B 125ms
22ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050075
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tmI4gRN%2F0dKgmSgdkQmLcNs8vxEF7QPNZQNJVwDodsziu5dq4IjCRztPp78U8ePtjsmiIEzx5Ba7RwaOBkmyWFKyV6DoobERDl5%2Flnu3yFtSXeFcpkr74XzhNaPMuk7Eqb%2BHDDdznz9z5vc"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d0915839a374350-EWR
Access-Control-Allow-Origin: *
Date: Thu, 10 Oct 2024 19:40:46 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 98D5 45 B
286 B 632ms
87ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

026ff7e1018173d45536782ed3c52f1b88a6bfc95ee8f45bc662936c681f93e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame 98D5 61 KB
740 B 146ms
23ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050075
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5pHqj7OjYK8ekLEWlpfOb3SlaVWrRSct3Xhcy2S1D5TDBO%2B9R%2FvZUmxN%2FfyIUCHJbmeW%2FHb6l6jWu3K2Ihns0zcAmeZtfaku8FphGm2J%2FZSxgokarneiPoQpjR1Fk2%2F59W%2BADJgEjdie8v2"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d091583ca714350-EWR
Access-Control-Allow-Origin: *
Date: Thu, 10 Oct 2024 19:40:46 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 19D0 45 B
286 B 716ms
87ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

2cda8e91f189fb5e7a5bfeedf249333086cd09c032613f048bf811cbb4967aa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.onworks.net
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ Frame 846B 156 B
534 B 60ms
25ms XHR
application/json 3.232.0.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.0.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-0-61.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 4fc8881adafb71daa5650a87aafda08ec27282a8e4f4ecad9d8ed768ea650f94

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.onworks.net
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 10 Oct 2024 19:40:45 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.53.224
server: Jetty(9.4.38.v20210224)

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/a/latest/ Frame 19D0 61 KB
738 B 147ms
23ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/a/latest/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Cache-Control: public, max-age=1800
Access-Control-Expose-Headers
Content-Encoding: br
CF-Cache-Status: HIT
ETag: W/"3bd20e5fbdd6d804d194856ed36c4ccb"
Age: 1050075
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCF%2BCPHkuLGDlCcoBlsrnYRyyXJUGurglYQpUe2ksdW4%2FZjn7PiUOLRSm9teXOiX1V%2Bp%2BxiSfbho3VWcDO3yBK0KfopzLdLihbyPsMlY4mHZVdSp3T%2FjAeQqw%2BGXrm7y7v8vOZUI4I4zKLQF"}],"group":"cf-nel","max_age":604800}
CF-RAY: 8d091583ea954350-EWR
Access-Control-Allow-Origin: *
Date: Thu, 10 Oct 2024 19:40:46 GMT
Last-Modified: Wed, 28 Aug 2024 15:06:29 GMT
Vary: Origin, Accept-Encoding
Server: cloudflare
Content-Type: application/javascript

GET
H2

200

/
ads.us.e-planning.net/uspd/1/ Frame 581D
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

0
0

36ms
35ms

Document
text/html

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

Redirect headers

content-type: text/html; charset=iso-8859-1
date: Thu, 10 Oct 2024 19:40:46 GMT
location: /uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 846B
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
759 B

132ms
102ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eHp2S9P6c2LijFNeTzoyiTayXekt4lPn4y%2FmF%2Fb%2FasIF3kDlrrOw820bnHjSVMTtSo478dMPOiJXbEKe3lbZb%2F%2BnX0Pv6g2LVXj9qMxJR%2B%2BMFw8g0l%2Bq9YPgYdjyimqaewYfVHD%2BFbfE"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09158b9a5c1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:46 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET
H2 200 cookie
cm.adform.net/ Frame C8D6 35 B
475 B 322ms
93ms Image
image/gif 37.157.6.237
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 846B 17 KB
13 KB 84ms
38ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd0315a225ea9822dba8228c968f0f4e71610dbf6d433e2db0db1ce8660fdd36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12797
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 846B 893 B
471 B 466ms
465ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=34199699128817&correlator=3592910489678294&eid=31079957%2C31084271&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_200x600_sidebar_right_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600%7C200x600%7C120x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246630&lmt=1728589246&adxs=1350&adys=400&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=0&ucis=3omsut2x87ju&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=523b54f6-b837-4eca-b295-f43e0b11cc3b&tdf=2&topics=1&tps=1&htps=10&a3p=EhoKDWNyd2RjbnRybC5uZXQSABiC38q_pzJIABIZCgp1aWRhcGkuY29tGKHUyr-nMkgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRih1Mq_pzJIAFICCGQSGAoJeWFob28uY29tGMPbyr-nMkgAUgIIbxIUCgVvcGVueBih1Mq_pzJIAFICCGQSGwoMMzNhY3Jvc3MuY29tGKHUyr-nMkgAUgIIZBIXCghydGJob3VzZRi_28q_pzJIAFICCGo.&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244829&idt=107&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=481353401&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ab6729dad7252f905a0d5d5cb4f41034767f9084b4647354e87a37811e7b7230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 440
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6C3F 0
0 167ms
25ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 846B 96 KB
31 KB 21ms
20ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.144.js

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C8D6 17 KB
13 KB 98ms
38ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b687694e242995d2ec7f35278d000d3d1ed995fe412e5b154fbb0e9526d0ef9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12847
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame C8D6 894 B
477 B 359ms
359ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1519173056770821&correlator=2368823017030817&eid=44809527%2C31083341&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_1200x300_top_billboard_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250%7C728x90%7C970x90%7C1200x300%7C980x300%7C1200x200%7C1100x200%7C1000x200%7C1000x250%7C970x300%7C980x240%7C980x120%7C970x200%7C970x120%7C728x100%7C728x250&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246652&lmt=1728589246&adxs=650&adys=2382&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=1&ucis=yjujwgxbs9z4&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=0a7586f3-1494-48b9-8134-af0a9c7064a1&tdf=2&topics=1&tps=1&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQYodTKv6cySABSAghkEhkKCnVpZGFwaS5jb20YodTKv6cySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKHUyr-nMkgAUgIIZBIYCgl5YWhvby5jb20YodTKv6cySABSAghkEhQKBW9wZW54GKHUyr-nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YodTKv6cySABSAghkEhcKCHJ0YmhvdXNlGKHUyr-nMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244698&idt=356&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=4136289833&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

403373b80c1d2910a851b3e95bda54a30923e94f67d15eceb8c53ade0055a04f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 446
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 34AD 0
0 163ms
29ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie
cm.adform.net/ Frame 19D0 35 B
483 B 436ms
161ms Image
image/gif 37.157.6.237
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 87F2
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
626 B

135ms
110ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GCD8Zsl6HT%2F77n9YNuqCfsFKu7qGMnBZ86L61%2BPbU9c3eA2KaaTWJ6qKYQW31NGNVifXAqDOF%2FkyvJEZ7MJ%2BKgGOkWszZBjmvIJt5bI5ZeCG%2F98%2Fdm57kM1BUE6nnXiQrWjG8cLd4HKW"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09158e7dd11a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:47 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame C8D6 96 KB
0 0ms
0ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2

200

/
ads.us.e-planning.net/uspd/1/ Frame 3170
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

0
0

33ms
33ms

Document
text/html

172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

Redirect headers

content-type: text/html; charset=iso-8859-1
date: Thu, 10 Oct 2024 19:40:46 GMT
location: /uspd/1/?ct=1&du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 39F2 17 KB
13 KB 92ms
45ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4a7cc3f0133fbb6dbc3f3b2db0343a40d457f84200b4072d9d701d4c450af53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12799
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 39F2 59 KB
14 KB 439ms
438ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3191922756934123&correlator=631348443207878&eid=31079957&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_1000x100_leaderboard_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C1000x100%7C728x90%7C990x90%7C970x50%7C960x90%7C950x90%7C980x90&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246705&lmt=1728589246&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=0&ucis=ilcmcch293bx&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=5204b262-ae29-4897-920e-3d3cbd296988&tdf=2&topics=1&tps=1&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQYodTKv6cySABSAghkEhkKCnVpZGFwaS5jb20YodTKv6cySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKHUyr-nMkgAUgIIZBIYCgl5YWhvby5jb20YodTKv6cySABSAghkEhQKBW9wZW54GKHUyr-nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YodTKv6cySABSAghkEhcKCHJ0YmhvdXNlGKHUyr-nMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244725&idt=410&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=3491453002&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cce7dd3ff1fe2f40cf5eba1143764463eb4a5a0f29a001994b4b16870e23a2fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

access-control-expose-headers: x-google-amp-ad-validated-version
content-encoding: br
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 14379
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BF1D 0
0 78ms
24ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 98D5 17 KB
13 KB 160ms
89ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba73323eb12b60b9b147f3b349de2461174081846bd256015d6a4d91b5d5ccd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12911
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 98D5 891 B
477 B 360ms
357ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4464467716380004&correlator=2445285737988725&eid=95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_970x90_sticky_anchor_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C1000x100%7C728x90%7C990x90%7C970x50%7C960x90%7C950x90%7C980x90&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246727&lmt=1728589246&adxs=0&adys=3149&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=1&ucis=67ioxqjreund&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=af6e70ce-d703-437d-98c4-cde614425e22&tdf=2&topics=1&tps=1&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQYodTKv6cySABSAghkEhkKCnVpZGFwaS5jb20YodTKv6cySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKHUyr-nMkgAUgIIZBIYCgl5YWhvby5jb20YodTKv6cySABSAghkEhQKBW9wZW54GKHUyr-nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YodTKv6cySABSAghkEhcKCHJ0YmhvdXNlGKHUyr-nMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244806&idt=510&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=2150855633&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1303ab66e7781fe03cfed1b5ec315232d15c838854d7a205be061977060826a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 446
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 466E 0
0 69ms
32ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 87F2 17 KB
12 KB 196ms
46ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df3df65c756867b0839b6623e4561bdedaa569f3af5031caaf33670d5563e338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12776
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 87F2 891 B
474 B 344ms
324ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1714012827047266&correlator=4078581909170704&eid=31083339%2C31087616&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_200x600_sidebar_left_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600%7C200x600%7C120x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246743&lmt=1728589246&adxs=100&adys=400&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=0&ucis=ri5qmwxai32&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=15f9545e-5e5f-4819-8fc2-be12d6d3cde9&tdf=2&topics=1&tps=1&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQYodTKv6cySABSAghkEhkKCnVpZGFwaS5jb20YodTKv6cySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKHUyr-nMkgAUgIIZBIYCgl5YWhvby5jb20YodTKv6cySABSAghkEhQKBW9wZW54GKHUyr-nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YodTKv6cySABSAghkEhcKCHJ0YmhvdXNlGKHUyr-nMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244635&idt=591&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=4227105449&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

580c2ff7239a7dd16688cca1abb4397228a8189b89c775f9e82a1d4357d4b605

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 443
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1E33 0
0 97ms
25ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 846B 638 B
1 KB 349ms
159ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

7184ddec30d9950650b1ad4b0eaea892ca272465a60ce9f3ef49dab722e6756d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json
vary: Origin

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame C8D6 638 B
1 KB 395ms
208ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

7f651bd7b6db2931357eeebaaa13b9d9c6aaf97c88dc9d45115ff5bbd7419e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: application/json
vary: Origin

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 39F2 96 KB
0 20ms
20ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 87F2 96 KB
0 21ms
21ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 39F2 638 B
1 KB 380ms
211ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

3ecac4be91775c27eedd45f4446f46b7cc36c8ae78b6398bf0d8c66a2d8bc214

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: application/json
vary: Origin

GET
H2 200 pd
google-bidout-d.openx.net/w/1.0/ Frame 0B58 0
0 114ms
18ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 452
content-type: text/html
date: Thu, 10 Oct 2024 19:40:46 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 846B 18 KB
7 KB 104ms
8ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 98D5 96 KB
0 8ms
8ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 19D0 17 KB
13 KB 185ms
37ms XHR
application/json 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202410070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

476654be617cd56c72e542c68b4408831b14d132ca8805d27fcfab596d9f9091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12958
date: Thu, 10 Oct 2024 19:40:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 19D0 895 B
480 B 363ms
348ms Fetch
text/plain 2607:f8b0:400d:c0b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=933596375713496&correlator=4371548259722826&eid=31079956%2C31086814%2C31085773%2C31085775&output=ldjh&gdfp_req=1&vrg=202410070101&ptt=17&impl=fifs&iu_parts=147246189%3A22385467611%2Conworks.net_1200x300_lazy_billboard_desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250%7C728x90%7C970x90%7C1200x300%7C980x300%7C1200x200%7C1100x200%7C1000x200%7C1000x250%7C970x300%7C980x240%7C980x120%7C970x200%7C970x120%7C728x100%7C728x250&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728589246801&lmt=1728589246&adxs=650&adys=2182&biw=1600&bih=1200&isw=300&ish=150&scr_x=0&scr_y=0&btvi=1&ucis=fatot9s7rvde&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&ref=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&top=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php&vis=1&psz=300x150&msz=300x0&fws=256&ohw=0&td=1&egid=59389&tan=4861efa4-2b3f-4b30-b0cc-01830cb61c76&tdf=2&topics=3&tps=3&htps=10&a3p=EhwKDWNyd2RjbnRybC5uZXQYodTKv6cySABSAghkEhkKCnVpZGFwaS5jb20YodTKv6cySABSAghkEh0KDmVzcC5jcml0ZW8uY29tGKHUyr-nMkgAUgIIZBIYCgl5YWhvby5jb20YodTKv6cySABSAghkEhQKBW9wZW54GKHUyr-nMkgAUgIIZBIbCgwzM2Fjcm9zcy5jb20YodTKv6cySABSAghkEhcKCHJ0YmhvdXNlGKHUyr-nMkgAUgIIZA..&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728589244849&idt=549&ppid=3d009340c867426889e02c80d90c9447&prev_scp=pbsd%3D1%26hb_env%3Dweb%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.00%26hb_adid%3D330f72b191eb866%26hb_bidder%3Doftmedia&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=1288007980&frm=23&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::9c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5513ed099fc87d7bd58e97895750876601852a5e12a75ba0afb7d6c33bd8508

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.onworks.net
content-length: 449
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8931 0
0 91ms
21ms Document
text/html 2607:f8b0:400d:c01::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410070101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c01::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
expires: Thu, 10 Oct 2024 19:40:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C8D6 18 KB
0 72ms
72ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 87F2 638 B
1 KB 333ms
212ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

8606cc424a2fcd1d9e98bf7294238e2f8d9a4eda28e80fca5ffcbb50893885b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: application/json
vary: Origin

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 98D5 638 B
1 KB 322ms
209ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

d3ad390a4b5c59de9a338176f25616f7d5f11c6837119335fa0e1d872dc5a9b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: application/json
vary: Origin

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 19D0 96 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 39F2 18 KB
0 51ms
51ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ Frame 19D0 638 B
1 KB 233ms
157ms Fetch
application/json 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

7ee043e10ae70dbee32fbaa1ccedfbe1cf1accce7b9d557b0dfe2355f4ba28d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://www.onworks.net/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.onworks.net
p3p: CP="CAO PSA OUR"
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: application/json
vary: Origin

GET
H2 200 syncframe
gum.criteo.com/ Frame 08CB 0
0 18ms
18ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 846B 96 KB
0 2ms
2ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 syncframe
gum.criteo.com/ Frame AC4A 0
0 12ms
11ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame C8D6 96 KB
0 5ms
5ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 syncframe
gum.criteo.com/ Frame B8D6 0
0 11ms
10ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 39F2 96 KB
0 0ms
0ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 syncframe
gum.criteo.com/ Frame EE9B 0
0 9ms
9ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 87F2 96 KB
0 1ms
1ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 98D5 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 syncframe
gum.criteo.com/ Frame F882 0
0 0ms
0ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.144.js Show response
static.criteo.net/js/ld/ Frame 98D5 96 KB
0 1ms
1ms XHR
text/javascript 2620:100:a00b::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"653b5c0e-1811e"
cross-origin-resource-policy: cross-origin
expires: Fri, 11 Oct 2024 19:40:46 GMT
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 87F2 18 KB
0 2ms
2ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 /
ads.us.e-planning.net/uspd/1/ Frame 1721 0
0 34ms
30ms Document
text/html 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H2 200 syncframe
gum.criteo.com/ Frame 266D 0
0 6ms
6ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.onworks.net
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:46 GMT
server: Kestrel
server-processing-duration-in-ticks: 873853
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 19D0 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:46 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame 123C 0
0 135ms
26ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame E7A0 0
0 476ms
31ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame ADA2 0
0 186ms
186ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame C493 0
0 469ms
469ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame BA39 0
0 193ms
193ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame C07F 0
0 468ms
468ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame C19C 0
0 160ms
160ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 4F13 0
0 417ms
417ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame A0DA 0
0 129ms
129ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame B98D 0
0 370ms
370ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame 1975 0
0 76ms
76ms Document
text/html 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:15:34 GMT
expires: Thu, 10 Oct 2024 20:05:34 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame F15B 0
0 319ms
319ms Document
text/html 2607:f8b0:400d:c0c::6a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0c::6a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-t-8SM9nua8dnIy86Hn7cWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 10 Oct 2024 19:40:47 GMT
expires: Thu, 10 Oct 2024 19:40:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 19D0
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
620 B

251ms
112ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8tw46F0F49c12pWopo2tHCP%2BH73dUR%2F8IV4Wf2s0OtDhSYUS%2BcxGieFdgS604cmOd3QwDctzD4Eaj83LDHBmyqfj2qBjbvtbBtgPZn8RtkiMroTCMwwOvY42h8VkZvlyiPtY6lVyqQFz"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09158f3ec01a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:47 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET
H2 200 b-904ac2d-53355591.js Show response
tagan.adlightning.com/setupad/ Frame E5F1 68 KB
0 0ms
0ms Script
application/javascript 3.171.139.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.139.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-139-30.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
etag: "05e9679509b61424a07cc4d4efb7247f"
x-amz-version-id: kPJhXXWG1Hq0AVBcmSAqAweMN.PW_rtc
age: 3891938
x-cache: Hit from cloudfront
x-amz-cf-id: hUHorCgKDurfMt3OYYlSgLPRViV-D6TLMkhJjpIx6ovB3XpqILSI_g==
date: Mon, 26 Aug 2024 18:35:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Feb 2024 15:54:08 GMT
cache-control: max-age=31536000
via: 1.1 11913fe47164f540bffea3dbbb63de92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 26319
x-amz-meta-git_commit: 904ac2d
x-amz-cf-pop: JFK52-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012406241625000/ Frame E5F1 196 KB
56 KB 315ms
21ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012406241625000/amp4ads-v0.mjs

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7330191facb7e2ececc564f92a6e4db89028c010eb1d46114c19615354f02bd1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: "cc18f0752fb26ed7"
age: 192987
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 14:04:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 14:04:20 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 56144
x-xss-protection: 0
server: sffe

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012406241625000/v0/ Frame E5F1 15 KB
5 KB 363ms
70ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012406241625000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63a8ed4d42e2e14d5eeb92b559c0942083d03c633e8aa8d82511b06057b5790c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: "a54ee7ef81300879"
age: 218515
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 06:58:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 06:58:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 5218
x-xss-protection: 0
server: sffe

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012406241625000/v0/ Frame E5F1 95 KB
28 KB 363ms
70ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012406241625000/v0/amp-analytics-0.1.mjs

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1dc183a1e37c034f6528f4768d7912a229f7f25f9e4ed4ad283d0b1d7630551

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: "ed67e306da4f50af"
age: 185681
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 16:06:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 16:06:06 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 29004
x-xss-protection: 0
server: sffe

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012406241625000/v0/ Frame E5F1 5 KB
2 KB 355ms
62ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012406241625000/v0/amp-fit-text-0.1.mjs

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bdb5fbbf823cdc9431ac0ac26c06d3106dbb27bed5297e1ff8a3da8d72a9bba9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: "318c9ffc754fdb7f"
age: 224598
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 05:17:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 05:17:29 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 1913
x-xss-protection: 0
server: sffe

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012406241625000/v0/ Frame E5F1 40 KB
13 KB 352ms
62ms Script
text/javascript 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012406241625000/v0/amp-form-0.1.mjs

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26dca3cd2ff32a9934a9fe12f32f973e38263f497e28ef43175d81b78af04be2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: br
etag: "6b189ee8e91db6e8"
age: 192525
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 14:12:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 14:12:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 12940
x-xss-protection: 0
server: sffe

GET
H2 200 css
fonts.googleapis.com/ Frame E5F1 18 KB
2 KB 275ms
44ms Stylesheet
text/css 2607:f8b0:400d:c1d::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/setupad/b-904ac2d-53355591.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c1d::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9bf164fd8f85bbe262753bca4167f5baacb295fa1f167e0dfcc43fbf3e21a876

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:47 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 10 Oct 2024 19:15:04 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
DATA 200
OK truncated
/ Frame E5F1 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d9162fe6e1560aa06a74bed237f9b2891517e0a27034da7d72376ad28644471

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E5F1 2 KB
3 KB 36ms
24ms Image
image/png 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 14819457070020093239
age: 60241
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 02:56:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2502
x-xss-protection: 0
date: Thu, 10 Oct 2024 02:56:46 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E5F1 295 B
399 B 36ms
16ms Image
image/png 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 426692510519060060
age: 12871
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 16:06:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 295
x-xss-protection: 0
date: Thu, 10 Oct 2024 16:06:16 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame E5F1
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CT6pEvi0IZ878Lpzorr4Pxa21qA-OoezleN6dqPZm4Iq7oOMMEAEgjeS9KWDJxqmLwKTYD6ABz-mI_wPIAQHgAgCoAwHIAwqqBKYCT9C_mm-MR5p1Q-NSb_V_oEhyeUhGW7K7iTMnu0rH...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x8f4e5066451e6d980000000000000000%22,%222%22:%220x4a1a513d6be73e990000000000000000%22,%223%22:%220xfa1a1b...

0
20 B

409ms
100ms

Image
text/css

209.85.144.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x8f4e5066451e6d980000000000000000%22,%222%22:%220x4a1a513d6be73e990000000000000000%22,%223%22:%220xfa1a1b601c99fc530000000000000000%22,%224%22:%220x2a4087d4fccf792c0000000000000000%22,%225%22:%220xa5163a3cee1c73ff0000000000000000%22},%22debug_key%22:%2211601413892667001679%22,%22debug_reporting%22:true,%22destination%22:%22https://smarterasp.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221071789263%22],%2222%22:[%22true%22],%224%22:[%2210-10%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2213933858613732386193%22}&andc=true

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Server

209.85.144.154 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

qv-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: private
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 19:40:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 10 Oct 2024 19:40:48 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x8f4e5066451e6d980000000000000000","2":"0x4a1a513d6be73e990000000000000000","3":"0xfa1a1b601c99fc530000000000000000","4":"0x2a4087d4fccf792c0000000000000000","5":"0xa5163a3cee1c73ff0000000000000000"},"debug_key":"11601413892667001679","debug_reporting":true,"destination":"https://smarterasp.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1071789263"],"22":["true"],"4":["10-10"],"6":["true"]},"priority":"500","source_event_id":"13933858613732386193"}
content-type: text/css; charset=UTF-8
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x8f4e5066451e6d980000000000000000","2":"0x4a1a513d6be73e990000000000000000","3":"0xfa1a1b601c99fc530000000000000000","4":"0x2a4087d4fccf792c0000000000000000","5":"0xa5163a3cee1c73ff0000000000000000"},"debug_key":"11601413892667001679","debug_reporting":true,"destination":"https://smarterasp.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1071789263"],"22":["true"],"4":["10-10"],"6":["true"]},"priority":"500","source_event_id":"13933858613732386193"}&andc=true
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 10 Oct 2024 19:40:47 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

POST
H2 200 node.php Show response
node.setupad.com/node/ Frame 39F2 0
241 B 740ms
108ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache
content-encoding: gzip
pragma: no-cache
access-control-allow-methods: GET, POST
access-control-allow-origin: *
date: Thu, 10 Oct 2024 19:40:48 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 39F2
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
830 B

186ms
109ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XmbcJSjrH%2FNk1z8UQeoTOn1ma895f4t0tJBzHCL58L%2FVC64RCfMNNEX32Afnd7J%2FmMvPO7t0IWJ72BDhX%2FtbD8rRQ3CnZ5fCgyEPTagRzJszwCLHK8MpOBYrUo%2BXDfXy%2BCnwixon0vso"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09158fffd31a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:48 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:47 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET
H2 200 sync
eb2.3lift.com/ Frame 16AC 0
0 31ms
14ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1340
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:47 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame E28F 0
0 507ms
17ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 sync
eb2.3lift.com/ Frame 37B9 0
0 49ms
22ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1340
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:47 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v61/ Frame E5F1 33 KB
33 KB 523ms
43ms Font
font/woff2 2607:f8b0:400d:c01::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v61/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c01::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.onworks.net
Referer: https://fonts.googleapis.com/

Response headers

age: 238866
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 01:19:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 01:19:42 GMT
last-modified: Mon, 12 Aug 2024 17:14:50 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34184
x-xss-protection: 0
server: sffe

GET
H2 200 /
ads.us.e-planning.net/uspd/1/ Frame 703B 0
0 49ms
35ms Document
text/html 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
expires: Thu, 10 Oct 2024 19:40:48 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame C8D6
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
668 B

166ms
157ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZL09J6J9wGvVZHOo%2FNwha0dM9YESPDe3vR6XV7%2BJwHvTpKFf0BJcYBQ3RPkt%2Fo9Dlj9mG%2BuGmI%2FJt7wxgnjaduR%2FbhEj9TMul1sxq2lRKnQCXaZnbSUIneb5L5MQQEweCYC4WQ4HYZDR"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d091591194f1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:48 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:47 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET

si
googleads.g.doubleclick.net/pagead/drt/ Frame E5F1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

GET
H2 200 sync
eb2.3lift.com/ Frame 5F6C 0
0 26ms
18ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1276
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:48 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E5F1 2 KB
0 4ms
4ms Image
image/png 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 14819457070020093239
age: 60241
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 02:56:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2502
x-xss-protection: 0
date: Thu, 10 Oct 2024 02:56:46 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E5F1 295 B
0 6ms
6ms Image
image/png 2607:f8b0:400d:c0d::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0d::84 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 426692510519060060
age: 12871
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 16:06:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 295
x-xss-protection: 0
date: Thu, 10 Oct 2024 16:06:16 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame 723D 0
0 21ms
20ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 3

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame E8F9 0
0 41ms
27ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 /
ads.us.e-planning.net/uspd/1/ Frame 250B 0
0 22ms
21ms Document
text/html 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
expires: Thu, 10 Oct 2024 19:40:48 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame D677 0
0 17ms
16ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-type: text/html
date: Thu, 10 Oct 2024 19:40:48 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame 57AC 0
0 67ms
17ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-type: text/html
date: Thu, 10 Oct 2024 19:40:49 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 pbs-iframe
pbs-cs.yellowblue.io/ Frame 7A89 0
0 154ms
0ms Document
text/html 52.2.246.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.2.246.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-246-163.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://www.onworks.net/
content-length: 932
content-type: text/html
date: Thu, 10 Oct 2024 19:40:49 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E5F1 42 B
65 B 265ms
192ms Image
image/gif 2607:f8b0:400d:c02::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsulWImPbpzbE9oK_Z3-UCRfA9eQ--nPCvmK8jv0XxpF_evA_Y80b3yp140zabyP6JY2Sxgd6I-TZWKlkZ8BKjQShSFkDE1_UPZTTdglYxsqp5vHjggNEJRYpMYwz6qNhchKh63lru38hqoYuxJv2ncAgmlLKd9dwyL-I-uKtVfZI-tbEEa8cSbXzEh10xCWUA&sai=AMfl-YRveQbkDXbcJFUJN-apASXgC8hhcieSyLVT1CB6bteL7XeXJG3NjBWfKldEm-2RvxgnkOZobrSnVBWDlESarl_S5ocjba1gIZK7xiab-Ipy0oyTPRVBELVTkaWWkok0AIXK2date965YMqbzXMTC3tSlJQNT8KZMqigOgke81uZMQDKOC3nqTGioLyodgQqUZhqV07OuekVP4LrOWX3tHBFFz7iCJCpDlcSdn0UKA&sig=Cg0ArKJSzEmFVRepzjQMEAE&cid=CAQSigEA6Wl537vEdJ1JvaZfbJYXh65ylChC6ZHuTSQblb8m2zuGaKcJ5s5SQ8wVbUqZL5tZNLNRpo3OM9wL6dAtLYzVU0Awwfds9IkvKGmCJPMoQybOnlu7TI8ZDRRWmjXqNxbLwM6OAPDGDmSYQKX-k-aKJoV2dBdbw60GYyjdB48wl9cDq2Px6Y4K33UYAQ&id=ampim&o=300,108&d=1000,100&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=808&tls=1809&g=100&h=100&tt=1809&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c02::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 10 Oct 2024 19:40:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 sync
eb2.3lift.com/ Frame 75E3 0
0 84ms
0ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:49 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 isyn
sync.a-mo.net/ Frame 0DC0 0
0 1294ms
44ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJGI2OTg2NmY1LTFjN2QtNDQ4MC1iODNlLTdlM2EzM2Q3MGMwMqIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 3

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame FF9E 0
0 1252ms
10ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET
H2 200 sync
eb2.3lift.com/ Frame AA4F 0
0 32ms
13ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 sync-all.html
adxbid.info/ Frame BFBE 0
0 1310ms
118ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H2 200 sync
eb2.3lift.com/ Frame A74D 0
0 15ms
14ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 846B
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0

43 B
475 B

25ms
20ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0
Content-Length: 0
Date: Thu, 10 Oct 2024 19:40:49 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 846B
Redirect Chain

https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=

43 B
793 B

24ms
22ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:50 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 10 Oct 2024 19:40:51 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 846B
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=160&partneruserid=1&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3...
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=Mzk2NjQ4MDcxNjAxMjEwMDg1NQ==&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEIlg16gd6mNriq6sEyKQ11I&gdpr=0&gdpr_consent=&google_cver=1

43 B
557 B

17ms
15ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEIlg16gd6mNriq6sEyKQ11I&gdpr=0&gdpr_consent=&google_cver=1
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:48 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEIlg16gd6mNriq6sEyKQ11I&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 345
date: Thu, 10 Oct 2024 19:40:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET /
csync.loopme.me/ Frame 846B 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 846B
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0

43 B
475 B

22ms
19ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:48 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0
content-length: 0

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 21E9 0
0 1176ms
1176ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET
H3 200 sync-all.html
adxbid.info/ Frame 87AA 0
0 1269ms
1268ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H2 200 isyn
sync.a-mo.net/ Frame B3DE 0
0 1202ms
47ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDFkZDQ5N2M3LWUyNDMtNDA1Ny1iYjMyLWNiZTU1YjI1YmE5OaIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 3

GET
H2 200 sync
eb2.3lift.com/ Frame 4948 0
0 17ms
15ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame C8D6
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=

43 B
456 B

23ms
22ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:48 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 02c6a62c-dafa-4fdb-8e9c-152863497379
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame C8D6
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3D...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=3966480716012100855&gdpr=0&gdpr_consent=

43 B
855 B

290ms
95ms

Image
image/gif

67.220.226.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=3966480716012100855&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

67.220.226.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 474RW3KXMREZFDSQNQQH
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 10 Oct 2024 19:40:49 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

cache-control: no-cache,no-store
location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=3966480716012100855&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame C8D6
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fdee39d7-0252-4a71-a492-d80fe3f7e3e9&gdpr=0&gdpr_consent=

43 B
515 B

21ms
17ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fdee39d7-0252-4a71-a492-d80fe3f7e3e9&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fdee39d7-0252-4a71-a492-d80fe3f7e3e9&gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1148634
expires: Thu, 10 Oct 2024 00:00:00 GMT
x-errorlevel: 0
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Thu, 10 Oct 2024 19:40:48 GMT
server: Kestrel

GET
H2

200

/
wt.rqtrk.eu/ Frame C8D6
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26...
https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3966480716012100855&gdpr_pd=0&gdpr=0&gdpr_consent=

43 B
352 B

1490ms
31ms

Image
image/gif

51.222.241.106
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3966480716012100855&gdpr_pd=0&gdpr=0&gdpr_consent=
Protocol: H2
Server: 51.222.241.106 , Canada, ASN16276 (OVH, FR),
Reverse DNS: haproxy-ca-012.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache,private
pragma: no-cache
x-envoy-upstream-service-time: 10
expires: Thu, 10 Oct 2024 19:40:50 GMT
content-length: 43
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
date: Thu, 10 Oct 2024 19:40:51 GMT
content-type: image/gif
server: istio-envoy

Redirect headers

cache-control: no-cache,no-store
location: https://wt.rqtrk.eu?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=3966480716012100855&gdpr_pd=0&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:48 GMT
pragma: no-cache

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame C8D6
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=64&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D68%26partneruserid%3D%7BuserId%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=68&partneruserid=895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&gdpr=0&gdpr_consent=

43 B
529 B

46ms
22ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=68&partneruserid=895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=68&partneruserid=895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 10 Oct 2024 19:40:49 GMT
server: A

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 846B
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

86 B
915 B

133ms
116ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CI%2B7QG35K6g4zwNXXbACucQMli%2FTokmn4lPLYhTIeH1NTQT0BW0K5E8dwE0XKLijBWM9llAL5iNVqwNsomwsZFHOtxt6SVbfL1KkpDvJzOCgsn0rdJpKtQc3fvSBP0BijqNZCVwBlT4X"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09159b6d5a1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:49 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 10 Oct 2024 19:40:49 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 sync
eb2.3lift.com/ Frame 9B74 0
0 26ms
15ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 isyn
sync.a-mo.net/ Frame EF8F 0
0 1138ms
44ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDhlOTdiMmNkLTE5MjEtNDhiMC1iNDVhLWNhYjhmYmYwZDIwM6IEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 2

GET
H3 200 sync-all.html
adxbid.info/ Frame FC8B 0
0 1204ms
1204ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H2 200 sync
eb2.3lift.com/ Frame 08C2 0
0 24ms
11ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame F86B 0
0 1145ms
1145ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET usermatch
ssum-sec.casalemedia.com/ Frame 39F2 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 39F2
Redirect Chain

https://equativ-match.dotomi.com/match/bounce/current?networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent=
https://equativ-match.dotomi.com/match/bounce/current?DotomiTest=7bd0e0eab4191422&is_secure=true&networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAEn-FuaYffnAIWt1keAQEBAQEBAQCTdvPDsQEBAJN288Ox&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&...

43 B
846 B

20ms
17ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAEn-FuaYffnAIWt1keAQEBAQEBAQCTdvPDsQEBAJN288Ox&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:50 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAEn-FuaYffnAIWt1keAQEBAQEBAQCTdvPDsQEBAJN288Ox&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
server: nginx

GET

get
uipglob.semasio.net/id5/1/ Frame 39F2
Redirect Chain

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-9c21SKAgJYN6uJRFJApXeDYLI9h4yvXwo3W5gO6f5w&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_...
https://id5-sync.com/c/102/102/8/2.gif?puid=3966480716012100855&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/102/2/7/3.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/102/2/7/3.gif?puid=960377318026395464&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=d565ed3f-30bc-4e74-8e23-a65db5ef6e12&ttl=%%TTL%%
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAM0VU7OEFsAABUvhpjfdg&id5AccountNum=155&numCascadesAllowed=9
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
https://ps.eyeota.net/match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/102/123/4/6.gif?puid=19277f2c3b4-1e100000010a57c8&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F3%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D

0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 39F2
Redirect Chain

https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=

43 B
549 B

16ms
14ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 10 Oct 2024 19:40:58 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 39F2
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=7492511013085685528&gdpr=0&gdpr_consent=

43 B
658 B

16ms
15ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=7492511013085685528&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:50 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=7492511013085685528&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Thu, 10 Oct 2024 19:40:50 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 846B 0
0

GET
H2 200 isyn
sync.a-mo.net/ Frame 1C09 0
0 1088ms
46ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJGZlZjBjMzVhLTE1Y2EtNDMxZS04NWViLWIzZGZhYjE3YjJhMKIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 3

GET
H2 200 sync
eb2.3lift.com/ Frame 9645 0
0 16ms
15ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 sync-all.html
adxbid.info/ Frame 88C4 0
0 1141ms
1141ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H2 200 sync
eb2.3lift.com/ Frame 6E24 0
0 19ms
16ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 5E4C 0
0 1069ms
1069ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame 98D5
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0

43 B
529 B

17ms
17ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://rtb-csync.smartadserver.com/redir?partneruserid=AAM0VU7OEFsAABUvhpjfdg&partnerid=127&gdpr=0
Content-Length: 0
Date: Thu, 10 Oct 2024 19:40:49 GMT
Server: gunicorn
Connection: keep-alive

GET usermatch
ssum-sec.casalemedia.com/ Frame 98D5 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 98D5
Redirect Chain

https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=

43 B
549 B

16ms
16ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=3417573957596807279&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 10 Oct 2024 19:40:50 GMT

GET
H2 204 user-sync.html
ms-cookie-sync.presage.io/ Frame 98D5 0
170 B 1348ms
20ms Image
text/plain 3.208.132.83
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ms-cookie-sync.presage.io/user-sync.html?equativ_id=SMART_USER_ID&source=equativ&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.208.132.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-132-83.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

surrogate-control: no-store
expires: 0
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
x-powered-by: Express

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 98D5
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=acff26fe62

43 B
594 B

23ms
22ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=acff26fe62
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=acff26fe62
via: 1.1 6261076d910bd4aa39084fae9b6733ee.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: CAvppnspqHRGFN3F_aki-d0LPoGy2-YEXnk7rUSWmLClIMAehMTghw==
date: Thu, 10 Oct 2024 19:40:49 GMT
x-amz-cf-pop: JFK52-P7
server: CloudFront

GET
H3 200 sync-all.html
adxbid.info/ Frame CAC5 0
0 1111ms
1111ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H2 200 isyn
sync.a-mo.net/ Frame 13BA 0
0 1034ms
45ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDBiZmIzZjg5LTdlNTMtNDExYi1iMDIwLWE1OWZlODQ4MWUyNqIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 2

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 9588 0
0 1051ms
1051ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET
H2 200 sync
eb2.3lift.com/ Frame B857 0
0 24ms
23ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 sync
eb2.3lift.com/ Frame CA6D 0
0 56ms
24ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 87F2
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=

43 B
579 B

17ms
16ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=960377318026395464&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 506e8c67-e457-4a98-aedf-50b21dadb902
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 10 Oct 2024 19:40:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET /
csync.loopme.me/ Frame 87F2 0
0

GET
H2 204 user-sync.html
ms-cookie-sync.presage.io/ Frame 87F2 0
169 B 1320ms
12ms Image
text/plain 3.208.132.83
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ms-cookie-sync.presage.io/user-sync.html?equativ_id=SMART_USER_ID&source=equativ&gdpr=0&gdpr_consent=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.208.132.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-132-83.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

surrogate-control: no-store
expires: 0
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
x-powered-by: Express

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 87F2
Redirect Chain

https://s.company-target.com/s/eqx?sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D152%26partneruserid%3DPARTNER_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?gdpr=0&gdpr_consent=&issi=1&partnerid=152&partneruserid=7af3d1d6-011b-4452-9d1b-6fa7140e9aaf

43 B
635 B

18ms
17ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?gdpr=0&gdpr_consent=&issi=1&partnerid=152&partneruserid=7af3d1d6-011b-4452-9d1b-6fa7140e9aaf
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
location: https://rtb-csync.smartadserver.com/redir/?gdpr=0&gdpr_consent=&issi=1&partnerid=152&partneruserid=7af3d1d6-011b-4452-9d1b-6fa7140e9aaf
access-control-allow-methods: GET,OPTIONS
via: 1.1 google
access-control-allow-origin: *.smartadserver.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174
date: Thu, 10 Oct 2024 19:40:50 GMT
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 87F2
Redirect Chain

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ss...
https://x.bidswitch.net/sync?dsp_id=440&ssp=smartadserver&user_id=dTo5NzBvVVFUUTZZSXpkbE1RU2k3TTA=
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=

43 B
887 B

18ms
16ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:51 GMT

GET
H2 200 sync
eb2.3lift.com/ Frame E062 0
0 17ms
16ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 98D5
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

86 B
906 B

168ms
107ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYxWqLEXlZlgNVmvb%2Bu61rGhVcHSGhGgmKhooexuMcDScWScWAmGGaB4KLodKAbvXFpeRSIuexntd57mPrc8PKx63Adc0QF2BR8Rv%2BlBJwqrltRx8eQqL9g7NB5FYJ0SIOHE0w5fsDb%2B"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09159c4e3e1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:50 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 10 Oct 2024 19:40:49 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 isyn
sync.a-mo.net/ Frame 8200 0
0 883ms
46ms Document
text/html 125.253.89.176
SS-ASH

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---&_e=Cv0BSg93d3cub253b3Jrcy5uZXRSC2Fhcy0zZGJhOGU1WghwYmExLjMuM2oPd3d3Lm9ud29ya3MubmV0-gEGOC4yNy4w6AIBiAO926C4BqgDNuoDJDRiNTBjYTJjLWY1YTMtNGUyNy04YjNiLTZkYjA1MGI1NjE1OKIEKmh0dHBzOi8vd3d3Lm9ud29ya3MubmV0L29ud29ya3NzZXNzaW9uLnBocKoEA0RDSLIFA1VTROoFB2Rlc2t0b3D6BQNhc2jABgDIBgGqBwN3ZWLKBwtvbndvcmtzLm5ldOAHAYIIC29ud29ya3MubmV0iggGY2hyb21lmQgAAAAAAAgAAA
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.176 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 654
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 2

GET
H2 200 sync
eb2.3lift.com/ Frame 0CE8 0
0 22ms
22ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 sync
eb2.3lift.com/ Frame C151 0
0 29ms
14ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 1ED1 0
0 888ms
888ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 30746
Cache-Control: max-age=86402
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 10 Oct 2024 19:40:51 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 May 2024 08:31:56 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: HIT
X-Cache-Hits: 96586
X-Served-By: cache-lga21959-LGA
X-Timer: S1728589251.499927,VS0,VE0

GET
H3 200 sync-all.html
adxbid.info/ Frame 7CD5 0
0 924ms
924ms Document
text/html 2606:4700:3030::ac43:8a0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:8a0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d0915a5cf0e4338-EWR
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:51 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3AIyxNTdppkGXR9Y9sEUqBv0%2FC04e4gm%2BkUYe36CCT1mcJ7md3CcKJEn2YpVVESPz0cbND%2BseHe4L2byA6cDRYtoJPnIHZod6g2dAPGrrUSO1v6TFU2au0wj2USiqYJ2vSYGh5IU1L2qA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 19D0
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0

43 B
529 B

23ms
18ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=6406cfd8-26c3-40ce-8369-4118afb5b61d&gdpr=0
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 19D0
Redirect Chain

https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=

43 B
793 B

16ms
15ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=e0673f44-65e4-4f7b-8d80-7806f047ca8d&gdpr=0&gdpr_consent=
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 10 Oct 2024 19:40:51 GMT
content-type: image/gif
vary: Accept, Accept-Encoding
server: OXGW/0.0.0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 19D0
Redirect Chain

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
https://match.deepintent.com/usersync/129/store?id=&ext1=smartadserver&ext2=2ca2151c-3bc8-43cc-8325-705d5f8078c3
https://x.bidswitch.net/sync?expires=720&dsp_id=422&user_id=di_ef21e5f83fc845b3914f1&ssp=smartadserver&bsw_param=2ca2151c-3bc8-43cc-8325-705d5f8078c3
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=

43 B
698 B

17ms
16ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:49 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2ca2151c-3bc8-43cc-8325-705d5f8078c3&gdpr=&gdpr_consent=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 10 Oct 2024 19:40:50 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 19D0
Redirect Chain

https://equativ-match.dotomi.com/match/bounce/current?networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent=
https://equativ-match.dotomi.com/match/bounce/current?DotomiTest=5678acdc48e41153&is_secure=true&networkId=9252325&version=1&nuid=SMART_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAHJqb6L_UNqAIuCS_qAQEBAQEBAQCTdvPDywEBAJN288PL&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&...

43 B
887 B

33ms
29ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAHJqb6L_UNqAIuCS_qAQEBAQEBAQCTdvPDywEBAJN288PL&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:50 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=155&partneruserid=AQAHJqb6L_UNqAIuCS_qAQEBAQEBAQCTdvPDywEBAJN288PL&expiration=1728675651&nuid=SMART_USER_ID&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
server: nginx

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 19D0
Redirect Chain

https://pxl.iqm.com/i/ck/equativ?cid=SMART_USER_ID&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D154%26partneruserid%3D%7BIQM_COOKIE%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=154&partneruserid=f408c218-d07d-4017-bc89-ccb8963fbf78

43 B
834 B

20ms
16ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=154&partneruserid=f408c218-d07d-4017-bc89-ccb8963fbf78
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

transfer-encoding: chunked
cache-control: no-cache,no-store
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 10 Oct 2024 19:40:51 GMT
pragma: no-cache
content-type: image/gif

Redirect headers

Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=154&partneruserid=f408c218-d07d-4017-bc89-ccb8963fbf78
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Content-Length: 114
Date: Thu, 10 Oct 2024 19:40:51 GMT
Content-Type: image/avif;charset=UTF-8
Server: openresty
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET sodar
pagead2.googlesyndication.com/pagead/ Frame C8D6 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 98D5 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 87F2 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 19D0 0
0

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 39F2 0
0

GET
H2 200 /
ads.us.e-planning.net/uspd/1/ Frame 914A 0
0 29ms
24ms Document
text/html 172.98.26.246
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.246 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Thu, 10 Oct 2024 19:40:50 GMT
expires: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: IAD-1211

GET
H2 200 sync
eb2.3lift.com/ Frame 5356 0
0 18ms
17ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: www.onworks.net
URL: https://www.onworks.net/onworkssession.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://www.onworks.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 10 Oct 2024 19:40:50 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 98D5
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_con...
https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855

86 B
879 B

109ms
108ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C8fQoncA%2BixBeqQGp9paXPcmckPku%2FbzI4CbOCbeehRjPL%2Fi%2FZEuHw%2FyQjLD6hitaoUQtEZC93Ngf1nn9iuwTJT57saEAHstgvyRBHQM8EfvvDHoRnMMsP3J60kyLO0ZSPUQ43sII8bR"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09159dd8bd1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:50 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

date: Thu, 10 Oct 2024 19:40:49 GMT
location: https://prebid-stag.setupad.net/setuid?bidder=smartadserver&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=3966480716012100855
content-length: 0

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 39F2
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

86 B
823 B

140ms
134ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TmQi2wiTDL9mPZxor%2FaKPUB9fggkKR3jhXuzm1dqQopKSCmT12IAvCtdeTQZiKlzYqlGiPP2x7UdCV4ti9V0astLPOcN%2Fokdno3Aj2Uge4Fx32hEB9J1UjJlfNjZqu9GNQb798V9oER7"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d09159e494c1a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:50 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 10 Oct 2024 19:40:50 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

setuid
prebid-stag.setupad.net/ Frame 87F2
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528

86 B
804 B

119ms
118ms

Image
image/png

172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
Protocol: H2
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.onworks.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrfb1I%2BJkmLDCSE05l1Pjk9ogJvBXBCX11ubBPaPFkWeOwYt6ktbi%2BLUoLLTupVE27eST9vF1Nt%2BDnj3G%2FDgPW4k5eckc7Jf%2BndiPr%2BuFqGfZaw8cZ%2By1aYoitpfDqgtjJHskAPTvlAG"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d0915a1ed691a44-EWR
expires: 0
content-length: 86
date: Thu, 10 Oct 2024 19:40:50 GMT
content-type: image/png
vary: Origin
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://prebid-stag.setupad.net/setuid?bidder=adform&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=7492511013085685528
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 10 Oct 2024 19:40:50 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: prebid-stag.setupad.net
URL: https://prebid-stag.setupad.net/openrtb2/auction

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Domain: csync.loopme.me
URL: https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=

Domain: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=179394&cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D33%26partneruserid%3D&gdpr=0&gdpr_consent=

Domain: uipglob.semasio.net
URL: https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F3%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=34199699128817&bg=!3t2l3ZLNAAax3igvkd47ADQBe5WfODSy0oDsx88VFX0uGLt9M-C2bT76bdnoUg-Lu5WVG9egEQbW4DKowyLTb7hYokoYAgAABHxSAAAABWgBB34ANhuGsO4WKK2HdRRchdwOLYnPuUE0wM44oy4IA1piRDwNuKowZjnMjgn7dVOfTtyGR4gPKzaZa5kCr1iIJ1GW7EIs5IYNU2C9GSOs0sAFgi8o7brOpSKOwNkUwdZly2SdmBsCJIroRHC5zImIGBFZmYvLB9gYmki4soAGCCzsrjRt9AX41H-Cvo8QHWtcrmSsVMui51yBxPOEda_1Z98yphpg_D5lf4o8jmZ4M5qA4cJKNGKdrGzpzli4Y7QEdgRCuSSVFt4jB-wc25a69QFyb96Gt6CcGfUwjUaGNVGmObrcVM0q4VAs0Zcb4rQTzJYnG9ou65vP0KMZWUQxJW64Urh0BfXD_jewGwZH3NBYQLcUsrXoSQPTGP59YL8-7IzW-wuq1RCcKUcCODzsz75pd7uP10fx1H19zADsuimB4ROhYKBGlz5IJlqY5_qYFgm2VW6bWcefPcnDJVovkn4NRRQdXu4bbj7K_Z2pq4f6J7zTmEADSCxDnI_AtAx0S31yGrcbGt-U_Xo5S1_WH_IKzYVXVH2qkMN7wm8OdoIoApWn1QNIM490OrIY_RdIxKUW83TkXXylmdq4wJhtiz0bsRYiROcwrw213iskT2BjgkFfYC45zQt721CDQd0sBU5MZOgEwFHjLfxHFEIVUj62N1B0HHNqniU1hxIdQlYtg0A0z4zH2fsHNTt3TlMKRTfMu_jeeiWRLlJQ5_2oifWViNpNcEHK5wUE0_bnclZvDzQv_qBuTaZ-i8qlE5v16tWTUHF_sUB0iJozxowKbMJf3fZw3bM_ZaTKHLlTObHBc-g-oyDkaDDrit5bNDsLNtwGSOEZableNi5-EsBAXtuJHoiax-RaHgG-1Hhwqa7JFcdljvU_r_CKgpqKRN4rewd3KGPJEkqo7B0pGlNV8G3_Mp9yCc53UCXAYsT9r-05o0HX3HEfXD9urs1rjXpXRTjf5CVHcK0cg_kwIk0E-OLNwV5Q0EaV9rPvLA

Domain: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=179394&cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D33%26partneruserid%3D&gdpr=0&gdpr_consent=

Domain: csync.loopme.me
URL: https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=1519173056770821&bg=!PT6lPnHNAAax3igvkd47ADQBe5WfOBjm-aks61WFX1Qc0OauU3ocFvdSoUkzYqsVz-sJcCUekSHxun-QIkcNJPw5qdibAgAABLJSAAAADGgBB34ANghprgC3skMlTfzd_oxPM_UsWEzzqsWWvoHNC33Js5t0OYqoQsZ65Kyuo0Ckhe1xHa17KdhfW5kCrzI5IWo2Z-iKy87o5kAp8UsPwPvBaVNN8iOK8vxoL3Itbwq5WKQPdx-cYiP0GnDhubIK-g6fOx1QOfVzDavrj_F02KG0-tggRzLltnRx3JIMDiaNR-kRTxgPoamcEf6o-Md3D8tolPeRS7JlH0ivfQdYOFYiYBXHTm1vbq-6_5du6Vawc8wl5FhPxEGdycFJ5xxm7S5q_N-fqeVrzyItahDPMRUQ9lJXKKZ3JpKRvSSAZjeGlGJ3E0N5jWfYGvMeDJHiD5dbY0f_5vFhL2V1Af_opMgxQiBMjs5Ghmp3c4Rr8Txeb7saAlC7IxBGTlUW8XM9FJ1bPvgPMnqy9MIz_OGvUvKAwmJCyD6vPJcE_j1aMG_zrg1JIOKvGqw4uN7xN3A60Jqbi_BJkezPXl9knc1_TKvxpdG45ifHZk7iqQwKldbKdNMGDs58tJE_4vwLc3zDuzuUl7EggKJe4AeXhkby_EcXFYyt79S6r0coUMVxGgsnv1snASTpMxkWNoEGlt1_sNKGRGTtVSUhWib-YCZcpVEkIM7lZ6PwBmV-A9bZG0G_dTFwHBn2-td-unWt4j86WU7tysphFqVGd1jnIh5OqfK1y4dR1vLTDgSk_82kgWMf4vg2eUYBkoCWzEBAl2w6Q6ZO1rPIdAMhSwE1C1IOC4nGHonlEB1nX67WYmoflcqFf6rEFeWnyCPvaVmFZ6tliSN5NRoJDM99vdsclOTZt8SqGapLxF8W1ZPgKefPw7KNBjD13h9W3Lpq1gfw8SuQnEexc4fmxyRhtMlbDnvdcIGBiD6zTjSqM9BerLoZxJIIoV0k8I3Wco743LhOOajiN7MT4E0MoygaGjfku6aRtiETz4te1XNocHsso68IYS0IizLloDOeRqI-CFLQ69qLWJmpBV3FwwGwy0AnIw

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=4464467716380004&bg=!SUqlSgXNAAax3igvkd47ADQBe5WfOJC9WOE1KbFc7M6OSvVPROOO63mRLHPRqG0i8ajGYc0O3KzlMqufGsfc-wL3SEPwAgAABIVSAAAAO2gBB34ANvHTsJTe1uZ2Zfcv9_HFyJLi2Q_iu-_60IvXG_GvI8flSG3cpoaQMJHODR9cavk_a4Ov6bYL_5kCxt9mwz1lSUsvzNWCbtjL47J5U48_6zxbq-wQF-xL-rXh17ZA6lhLMjhax_026ntUahTsJg2bfZaIimyXNMNZazDOzA_UQlwt68smgE9ICLqf8JzFnBdKHYHG2AJIUqTeMExbimlF6l_E9eVF9JX3Mws4Toj_LKioQixgKe_28p9fDrXoO6rCPpbkECQaw8Vj7Zf9K_w3tnJmsQt0foZQ6nVVILkoM9sBd3LQA8PwEs_bhepZN1kpsF7BmLREAZskdvm1aSxVeDmCR77YXBWalC1PZ3Q_yPwD8VGl2SFM6wseZw2PFW4pD_c3_Ukz5IwPjuyjEf45DcXi4d9RG6JIW-jlFq356OEWGj8kHHhTO-B3Q-bvvFrYnlw8zK3bYwHDJjVjKtr2MDgWXCAvvtwQWE-K25YL8F8xnEYypyRCKX5mU6-qxKt2EAyjT6VZg2AKxmj5fa55arfw5CQIl8ZNRS-xVsJHIkNGtKVQLoHS0sVTP8cZZKu_EpkTcvkRxPJrUo6Q9qboBSg7cLq_pc_nZK14NX4hKE2ERlrUinrieOBjKTcR5-8psApVuuUK-pQiLGZvpU54CVdNrLH1I1ZCoPvnpZOYxaXwWRvAWvI601BNb3R26EVRtIqEvKI45XEyccRHhdmiQMLUY5rJp7jnSfMR0fms2DeKjbmIyhNjLAYpeDMOz1Z9TwAzfQM-fol0y9Px2LJTtlqC1SZIBl1b503Obi2zFqvWsU0JIN5RCvFeDTesXkWhqCWUlqzDw5mj4cq7gfXi5BhoLZPfYxOHGdr1a5FezEQr6NH_fadcAUrT3sxuGtV5ttSvLlH0R1iCjXwH15HWLdZb5zNALzQeirU2HlnLt2yEaavJ5xS9jUlceBe9WOkBuXDjIla4b4wzoSXmbCWfweXJN_ogT7IuFIrscSTkL8TD_SakuLINXeXM5-gcoKBm

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=1714012827047266&bg=!XV6lXhHNAAax3igvkd47ADQBe5WfOE2J0nR7IaL-00h7YJgeYNdu_wVvrLnLGf3jbmUybzab8nEAWxVMc63QQy03-SlXAgAABHpSAAAAOGgBB34ANpprHv7D1DTTtjcZeBhVYkybPfFgdU6ntk1NYW3ZF1c_98TuuKnZ69Xxyu8dVFvRPx7zcybg_ZkCrl1SZXVlYvaPSJlJNW4H34PF7dvx1iwOA9jeWw4jIuUywjky6YhPJbn-TlK-YHGBbmZZL80Hf9LwOlyyPNkmMdeJmnL70eaAibfa1FbpRqGvHEUj7jdOhMKoQGfOZx4M7AIQ6_oBncdfi_9fMaVyHIpZ-mHI6e5p-Qud8LlRZo_1kO_0CoDqJ8iXuwBEyHj4-cfrj6Bw_8svyK1ChGk5sZV0gtsp_Kfm0TddtrZABZUfmsuQ800_R9EpSz0ZXqXOA2AUqIwn-gM0PmGF6kPXPzlf7ioKliGVnp9crP5zqfSUI0MJlOOVSoXNSFcEJ8MjoQ4MPLqDPmyQhVT75gIlikj3vBiwWDfdISSpjyXxL-L8Kp42_sscxcxz0290LCfSWWlbJ2l5-HFEFj1xUFzXrjb7Hzaz2EY55CCPdcejkmaZ3t6mJShL9S1ieAwlFUV9cUlp1biYqnuTr_cKsa8mMjVl8jNHDSVUpe54lgRVXp7vL8rELiYBjojWd57fnELdwNAkUElhTctyHCVhXwZwn_38tSlyAqexoJTceNOzQUSaEO2T4bXq0RfZUPRN_A7MnSoSUN7qworrLE0Ok3UdrEX-a5oky6VgjLYC73iFBC66R3HdS4U3AEZYCAT6Fk2SzU-1CPey9jdU7K2BR6TKEMjJ27INKZ1LRer_MiZ-XECGtbHs2zKPpJJ4Z_lbJThbQAGgPPr7CaHUrDe3mef12-0sik9AASPUxIoNsz95_vZNKWwazkfxHE5inpKbqV90iSGH-71teeju5znj4NBeI1wuIUubT6fRkDPeXjUxfc4sv1oZIvl5VFIFxfdVvqz_0ByKL7W_0eb9NFxLxs7pCQ0jRIW23qudqN1lqW70yIYhQO-y7AmGcCYYArKiMRszP7EDfsKQffd_w7WDW2Zy

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=933596375713496&bg=!XF-lXxDNAAax3igvkd47ADQBe5WfOBobC6gNQvDg6nCjs7t1OFE-HHlK6KfQOKcfQraga7sJCbnU2yy8o0SRohbRAw4rAgAABHVSAAAACGgBB34ANm7r2L2ruC7HkTxeN1ykj9XtUyXBjURhIkeHcsReamtDQCET7aZi417_8XVsqC09yZTuAes9iZkCvEGH--X_-o9js-mg58rLxHM4xXpXJ7qxLJ3Y2UMywf0HGWtyuzrimgz6ioL9T1d436wond3K-LGYjA4ieKb6RQHubEG2mfxEfRl20hgO36XzlA5IHoVeOkA8U4_AvLIsUO1VHbh94X_YSwFmTwoDW-U5zabodtVIfvRDuAMxo5l_JuRATckevVtZwDZ1RZsMpXDIrw7AE5L7JAH0sM3GSHSWc64QlNrcWrG0IqrTWpWH-DSU0ZAiJk46rgZIQlM9G0YLJnvhiaEgkRkXgvd_I69EQ3Ebd49gP4_tSFbI_xbjBkWKwkgQZ2BmckpGt4KHsKhG4F4aa-V-HHFTFv4vnwlo0vng_BaUfiI-95tXCsPL4oSMZwbM9RSMDq4yHpamhHJzBHYF-eUON7Rg1PMZ5U3zUjLAKIFHkhTIF0QConkmHpXc7Le-8ovSKAE5duqhak-wyiUkiYTKK38YvR_B3MJqRrX3eyBrqpQIfySe_zwbv-ey4wbs0p9tJf8d4TRzrlsB6VxdXlxTlq1gpARo2qwAGobqoTzEdJ0Dfnngm2U9OzMeKDJGyyx0W_RNuRcIMAWRDBn6sT0FsmomwBs2gWAhIfkKs_CFOnNoPXd-V5DL4KomaQBX3hYHVLCgCfG36GJOB12_Qr2o6bzdIxq8uzLvBrBpLuNSiIpn19d7SeIM5HD-VVHFYiFREY7uy2sngJkai0ohVcmDfW_RZ-IHWibUElESmw7X7MnutyuecuOt25T-Zvm0ozwSGtrfOHxaCNYbjMWWNpZqSWh2dCF_1CSMp-5FzxxE5pNMPmYM0ECjICzX1k3CuuofwwfGlQb2iAEDPujFC2hIvtrAJlyswadFN5dpWMCcWZ2uMeWFc-JezR_HJtXPkSzxsfp90AEN6EBGOp3hyUAZfmOA5uaBUnCuv4_NmihtELjATbs

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202410070101&jk=3191922756934123&bg=!MTKlMn3NAAax3igvkd47ADQBe5WfOCzD3luah2fjk8xfxKWO5WrO1UVi5YphbRKO8OyZTP2yJzmDtXmoYsyPzCjADBT-AgAABJlSAAAAJGgBB34ANjks0jEDE7f3U88esVx4GsGbEQTSoxXKw0z37YBYVuuHtoTU9J13dvtpXlwv1p-xGqo_PODBBAoAbEQ3YzulrQ-5-6sV-rgCG35aSukyippYMEY-scywLVEHS-i9-XRelsCzjyPeb9k62QXYe6yMt_J7CreojJkb43EF3aFg7jNFbGwajkIyL6RD1gkPxXdlZdzEEQHNEB96CoV81KuUAtrONDhxIJkCsPHXoqmTuAY0NGyFRzRbm74qVSXf820TqvG6fJbyzOzJr8iIDZmBv2DX9nVqDRjHnYOKgLjPyI3tlXbJP_xtE4XfJmw_c66LoLJG04GDnkrFbBesAMN32_aJJJGWt4uBR5e2Ax3TMkjKNKb-c9WUeBPGKqCvxOgFlIMlTdcpGmxPr1n4x19lYScWiINwEcadHTs9zDW2_iNONhlxKg0HQOgWS8LuqUjAblvWmaJ6Lk7PpyAyMYOsqyXgOigimY3qcTSXtIRHjONqzaHrZthpHuBRol1toGbIMGnJFnxjrlpMFgZjwh6Ie6F1-QyjwxKUf-HW7Jd1st3zFklQbuo7MEs-PEu-GcMVwtOEBR-IBFxkdE3j3IZ_vMLjq-NkLQfvrqo3MAr2XfhTSds949tnKbe-3o_2YGhoSb6RakTjZbIL_Ijupc0CBQDf0Apwr4Zq8PUV6lH5aCY__IvSmGimvry1juWAWXSNqlWEg1ZTCzPOoOGowLiSPNmld15KwdVY0OwM0g6EpVJPY_mlKCu-sIjeyczt5VW7BWqxZ_rQOjnE8oJEgULYeHuHFo6uGvdkogr5wa87RDpJkwTbxJSQtCFj4ggxk7rVKeZuW-bOyaJ_9hjvuph60EceNM01QcPJbPujyGDEec64Yh0fql28B0lZzsFihuvjmyerbFCvBIdLDGLan0E2Z-ohsDSY5ZWNXrO-PzeVxnOLPUzWGf_s_ceUfyky7nq1Q3vBfdtGgZaQJ4KS1lpKXanYs6Nw-TkvBCl-iJmQ20UZkFraBs7WgNcmycsj0Zz2x0foToD3rEskBS55zQTh-grgOrgwpuqClo1dSoEcTf0fPNEIeCZ95uBXEOQtm4lJAI-0aCV-GdBxAT00jd0YAm_WmkaOozO-UvLPsYUt3vz0u5gGzYMOQI4

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

273 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.3lift.com/sync	1970-01-21 02:19:25	Name: sync Value: CgoIgAIQ6eXKv6cyCgoIgQIQ6eXKv6cyCgoIggIQnO_Kv6cyCgoIhwIQheXKv6cyCgkICxDp5cq_pzIKCgiLAhCU68q_pzIKCgiMAhCF5cq_pzIKCgiOARCU68q_pzIKCQgOEJzvyr-nMgoKCI8CEPHxyr-nMgoKCJACEJzvyr-nMgoKCJECEJTryr-nMgoKCJICEJTryr-nMgoKCJMCEJzvyr-nMgoKCJQCEOnlyr-nMgoKCJUCEJzvyr-nMgoKCJYCEPHxyr-nMgoKCJoBEPHxyr-nMgoJCBsQheXKv6cyCgoInQIQ6eXKv6cyCgkIHxCU68q_pzIKCgifAhDx8cq_pzIKCgihARCF5cq_pzIKCgiiAhDx8cq_pzIKCQgkEPHxyr-nMgoKCKgCEJv1yr-nMgoKCKkCEJv1yr-nMgoKCKsCEJv1yr-nMgoKCKwCEIXlyr-nMgoKCK0CEIXlyr-nMgoKCK4CEJv1yr-nMgoKCLECEPHxyr-nMgoKCLMCEJzvyr-nMgoKCLQCEOnlyr-nMgoKCLUCEJzvyr-nMgoKCLcCEJTryr-nMgoKCLgCEPHxyr-nMgoKCLgBEPHxyr-nMgoJCDkQlOvKv6cyCgkIOhCF5cq_pzIKCgi6AhDx8cq_pzIKCgi7AhCU68q_pzIKCgi9ARCb9cq_pzIKCQg_EJzvyr-nMgoKCMIBEJv1yr-nMgoJCEkQ6eXKv6cyCgoIzgEQ6eXKv6cyCgoI1gEQnO_Kv6cyCgoI3gEQ6eXKv6cyCgkIXxCF5cq_pzIKCgjfARCb9cq_pzIKCgjiARCF5cq_pzIKCgjjARCU68q_pzIKCgjmARCF5cq_pzIKCgjnARDp5cq_pzIKCgj7ARCc78q_pzIKCgj_ARCU68q_pzI=
.onworks.net/	1970-01-21 09:45:49	Name: _ga_DN38F0DWYD Value: GS1.1.1728589244.1.0.1728589244.0.0.0
.onworks.net/	1970-01-21 09:45:49	Name: _ga Value: GA1.2.895941695.1728589245
.onworks.net/	1970-01-21 00:11:15	Name: _gid Value: GA1.2.1322158524.1728589245
.onworks.net/	1970-01-21 00:09:49	Name: _gat_gtag_UA_117545413_4 Value: 1
.onworks.net/	1970-01-21 08:55:25	Name: _sharedID Value: 3d009340-c867-4268-89e0-2c80d90c9447
.onworks.net/	1970-01-21 08:55:25	Name: _sharedID_cst Value: zix7LPQsHA%3D%3D
www.onworks.net/	1970-01-21 00:09:51	Name: stpdOrigin Value: {"origin":"direct"}
.prebid.a-mo.net/	1970-01-21 08:55:25	Name: __amc Value: 1_1728589245_1728589245
.adnxs.com/	1970-01-21 09:45:49	Name: receive-cookie-deprecation Value: 1
.a-mo.net/	1970-01-21 08:55:25	Name: amuid2 Value: e99ef80b-6c41-4fd8-a7c6-a7c50717d3f5
.a-mo.net/	1970-01-21 08:55:25	Name: pamuid2 Value: e99ef80b-6c41-4fd8-a7c6-a7c50717d3f5
.prebid.a-mo.net/	1970-01-21 08:55:25	Name: psd_amuid2 Value: e99ef80b-6c41-4fd8-a7c6-a7c50717d3f5
.prebid.a-mo.net/	1970-01-21 08:55:25	Name: sd_amuid2 Value: e99ef80b-6c41-4fd8-a7c6-a7c50717d3f5
.criteo.com/	1970-01-21 09:31:25	Name: uid Value: fdee39d7-0252-4a71-a492-d80fe3f7e3e9
.criteo.com/	1970-01-21 09:31:25	Name: receive-cookie-deprecation Value: 1
.3lift.com/	1970-01-21 02:19:25	Name: receive-cookie-deprecation Value: 1
.3lift.com/	1970-01-21 02:19:25	Name: tluid Value: 557805232754104860835
.openx.net/	1970-01-21 08:55:25	Name: i Value: 264297e5-5da1-4fe0-90c4-0ed2b27322b6\|1728589245
.crwdcntrl.net/	1970-01-21 06:38:35	Name: _cc_id Value: c6baa53326c5e7c0586a86024ecd103e
.yahoo.com/	1970-01-21 08:55:46	Name: A3 Value: d=AQABBL0tCGcCEMTblyrNLmnC_VsL_AKnyKgFEgEBAQF_CWcSZ9xC0iMA_eMAAA&S=AQAAAhr51_PWz7RvipcV78AvWfs
.smartadserver.com/	1970-01-21 08:55:25	Name: pbw Value: %24b%3d16999%3b%24o%3d99999
.smartadserver.com/	1970-01-21 08:55:25	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-21 00:11:15	Name: sasd Value: %24qc%3D1500046237%3B%24ql%3DHigh%3B%24qpc%3D10020%3B%24qt%3D152_1829_29211t%3B%24dma%3D501%3B%24qo%3D6
.adnxs.com/	1970-01-21 02:19:25	Name: icu Value: ChgIuJJ8EAoYASABKAEwvtuguAY4AUABSAEQvtuguAYYAA..
.criteo.com/	1970-01-21 09:31:25	Name: cto_bundle Value: d6awIF9VWUhDTkwlMkJ2QSUyRnVkckNEN2pqSkROWDg2QlVRT0Y0VjVVMSUyRiUyRkRIMlZIJTJGZ29OY0ExTWVMM2xKSVd3ZHJNNHhoVHVqNFgwJTJCejVpTXJpZjc0JTJCMHdFRUdURDglMkZjWFdkcVo4U05WaVM1bUxUTWclM0Q
.smartadserver.com/	1970-01-21 08:55:25	Name: pid Value: 3966480716012100855
.smartadserver.com/	1970-01-21 00:11:15	Name: sasd2 Value: q=%24qc%3D1500046237%3B%24ql%3DHigh%3B%24qpc%3D10020%3B%24qt%3D152_1829_29211t%3B%24dma%3D501%3B%24qo%3D6&c=1&l&lo&lt=638641860458396018&o=1
.adnxs.com/	1970-01-21 02:19:25	Name: XANDR_PANID Value: fyDJRbf5zj12MiPaz2t6EBMKUN8J6ZFEraSHXy0wHQlhEmkyaFEmK6lqYHBPnbwiwVwyP56v_mOotetEiFwPo2rJ_eq8JDOCv5g9RHeauP4.
.adnxs.com/	1970-01-21 02:19:25	Name: uuid2 Value: 960377318026395464
.4dex.io/	1970-01-21 01:36:13	Name: uids Value: eyJ1aWRzIjp7ImFkYWdpbyI6eyJ1aWQiOiJmMDM5ZDQ4YS1jYjE3LTQ1MGMtODU3Zi01NjQyNDUzZGIxZGUiLCJleHBpcmVzIjoiMjAyNC0xMi0wOVQxOTo0MDo0NS44NjM5MDA4NzdaIn19LCJiZGF5IjoiMjAyNC0xMC0xMFQxOTo0MDo0NS44NjM4NTMzMzdaIn0=
.onworks.net/	1970-01-21 09:30:49	Name: cto_bidid Value: VyDwlV9XaVQyVUJyR2dpZjVXUG9PSXNFYnY1UWxWVSUyRk1qZEJ1aXgxb2N0VlpGNUxiaUQzbEdza05JQlhKVHJIczB5TlRDZXRvWGpIdEhBUUhKTktKc1Zzcm5RJTNEJTNE
.onworks.net/	1970-01-21 00:09:49	Name: lotame_domain_check Value: onworks.net
.onworks.net/	1970-01-21 06:38:37	Name: _cc_id Value: c6baa53326c5e7c0586a86024ecd103e
.onworks.net/	1970-01-21 00:11:15	Name: panoramaId_expiry Value: 1728675645967
.onworks.net/	1970-01-21 08:55:25	Name: connectId Value: {"ttl":86400000,"lastUsed":1728589246340,"lastSynced":1728589246340}
ads.us.e-planning.net/	1969-12-31 23:59:59	Name: CT Value: 1
.e-planning.net/	1970-01-21 09:45:49	Name: E Value: ACDIvPaU7C/LuF/8
.admanmedia.com/	1970-01-21 00:29:58	Name: admtr_red Value: undefined
.disqus.com/	1970-01-21 08:55:25	Name: zeta-ssp-user-id Value: ua-924c04d9-6e14-3579-af73-95bfc01d76aa
.admanmedia.com/	1970-01-21 00:29:58	Name: admtr Value: 13eaf796-c83d-4b80-90e2-2fa85bc61f7f
.rtb.om-meta.com/	1970-01-21 08:55:25	Name: om-bidder Value: 421fDBpEBJE3mW0hcWmY9O8HZGykQWxr/2aIrBFfhdO6YRqoIP6aJUWnwkD7u0rX
.contextweb.com/	1970-01-21 08:48:13	Name: V Value: 41r2Gmozn9Y5
.contextweb.com/	1970-01-21 08:48:13	Name: VP Value: part_41r2Gmozn9Y5
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: d8691afacf46abf0
.sharethrough.com/	1970-01-21 00:53:01	Name: stx_user_id Value: 6406cfd8-26c3-40ce-8369-4118afb5b61d
.openx.net/	1970-01-21 00:31:25	Name: pd Value: v2\|1728589246\|vMgavPkWgy
cookies.nextmillmedia.com/	1970-01-21 00:19:54	Name: NMUID Value: 47eabbf2-50f1-4c50-9088-e89eed52d51f
.mgid.com/	1970-01-21 00:29:58	Name: lmg_r Value: 27
.3lift.com/	1970-01-21 02:19:25	Name: tluidp Value: 557805232754104860835
.adform.net/	1970-01-21 01:36:13	Name: uid Value: 7492511013085685528
.pubmatic.com/	1970-01-21 08:55:25	Name: KADUSERCOOKIE Value: 80D6D8E8-9065-4FBA-8CE5-009384A31ABE
.mgid.com/	1970-01-21 00:29:58	Name: lmg_usr Value: 2e7a1b61-ec57-403d-ae73-082fe4e8c10a
.krushmedia.com/	1970-01-21 00:29:58	Name: krm_usr Value: 3670a19c-fa9e-5b60-89e7-44a6a73ba87d
.adsrvr.org/	1970-01-21 08:55:25	Name: TDID Value: d565ed3f-30bc-4e74-8e23-a65db5ef6e12
.amazon-adsystem.com/	1970-01-21 06:29:58	Name: ad-id Value: A-WmUbOafUvFlWV3Uu5MJIs
.amazon-adsystem.com/	1970-01-21 09:45:49	Name: ad-privacy Value: 0
.adkernel.com/	1969-12-31 23:59:59	Name: SSPZ Value: 202990
.adkernel.com/	1969-12-31 23:59:59	Name: DSP2F_77 Value: 688143
.doubleclick.net/	1970-01-21 09:45:49	Name: IDE Value: AHWqTUnJoD04xIsdDSael5y0P2rbQK0meLNuLIqqnZmRJFQG99KLCf7gbnvLexRmA2Y
.adkernel.com/	1970-01-21 00:53:01	Name: ADKUID Value: A7811313470391846758
.visiblemeasures.com/	1970-01-21 00:29:58	Name: vm_usr Value: b5082ccc-a05b-4660-a1d0-80af27c1a458
.visiblemeasures.com/	1970-01-21 00:29:58	Name: vm_r Value: 94
.deepintent.com/	1970-01-21 09:45:49	Name: CDIUSER Value: di_ef21e5f83fc845b3914f1
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_80 Value: 22987-CAESEAXa3s23ZxZ19LgVvZqhUmI&KRTB&16514-CAESEAXa3s23ZxZ19LgVvZqhUmI&KRTB&23025-CAESEAXa3s23ZxZ19LgVvZqhUmI&KRTB&23386-CAESEAXa3s23ZxZ19LgVvZqhUmI
.sitescout.com/	1970-01-21 08:55:25	Name: ssi Value: 895f1bd0-ae18-4f3e-8b50-fc639b59670e#1728589247699
.w55c.net/	1970-01-21 09:40:03	Name: wfivefivec Value: Vk5rFk2N1SYZ1J5
sync.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id Value: s%3A0-b31fcb78-f988-569b-525e-c593db81bf8c.528c4GUTz6ZsXouee5jkmamBQ7PfRtlD29Fdyu0FVpg
.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id Value: s%3A0-b31fcb78-f988-569b-525e-c593db81bf8c.528c4GUTz6ZsXouee5jkmamBQ7PfRtlD29Fdyu0FVpg
sync.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id-v2 Value: s%3Asx_LePmIVptSXsWT24G_jAW16oY.I5OZsvRNaxdwvmelZoAyfWIxYAIJ472beMeZMusO3Wk
.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id-v2 Value: s%3Asx_LePmIVptSXsWT24G_jAW16oY.I5OZsvRNaxdwvmelZoAyfWIxYAIJ472beMeZMusO3Wk
.adentifi.com/	1970-01-21 09:45:49	Name: adtheorent[cuid] Value: cuid_8c38d940-873f-11ef-b1d6-12db0105501f
.turn.com/	1970-01-21 04:29:01	Name: uid Value: 3417573957596807279
.simpli.fi/	1970-01-21 08:56:51	Name: suid Value: 33DF9C8004A94EBC82FE606C9C4B7E69
.lijit.com/	1970-01-21 08:55:25	Name: ljt_reader Value: JeYcAQZHYBxODIdtQQy1Xqdw
.ipredictive.com/	1970-01-21 08:55:25	Name: cu Value: 93df7d63-4f76-4711-b2a9-784c73bae89d\|1728589247700
.quantserve.com/	1970-01-21 09:40:03	Name: mc Value: 67082dbf-ab70d-0a840-4df4c
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_377 Value: 6810-d565ed3f-30bc-4e74-8e23-a65db5ef6e12&KRTB&22918-d565ed3f-30bc-4e74-8e23-a65db5ef6e12&KRTB&22926-d565ed3f-30bc-4e74-8e23-a65db5ef6e12&KRTB&23031-d565ed3f-30bc-4e74-8e23-a65db5ef6e12
.c.bing.com/	1970-01-21 00:19:54	Name: MR Value: 0
.zemanta.com/	1970-01-21 08:55:25	Name: zuid Value: wsyq8WxOK-AadZvtc-AP
.mathtag.com/	1970-01-21 09:35:44	Name: uuid Value: f9a66708-2dc0-4e00-a062-2e9ba76e4fe7
.onworks.net/	1970-01-21 09:31:25	Name: __gads Value: ID=4f8cd69f23f03027:T=1728589246:RT=1728589246:S=ALNI_Mad_NrbzfJ4aZbdPanLB87K0Vdv2A
.linkedin.com/	1970-01-21 00:11:15	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=3100:u=1:x=1:i=1728589247:t=1728675647:v=2:sig=AQGOu1Ru-mHrHsTCoKQpRS779QY_nu99"
.onworks.net/	1970-01-21 09:31:25	Name: __gpi Value: UID=00000f27e09fd671:T=1728589246:RT=1728589246:S=ALNI_MbQFhFoPtkxfoNekXFzL5OWF-QfZA
sync.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id-v3 Value: s%3AAQAKIEgH5wOz9NO5PStU46rmbXzsJbTOzAYU5i4bqwST5fnMEGcYBCC_26C4BjABOgS9RxseQgSpYiFN.0hnr%2BLvVHZSJcDItbwvYnZ5lqYc9HUW9fIuFla6%2B%2B4k
.srv.stackadapt.com/	1970-01-21 08:55:25	Name: sa-user-id-v3 Value: s%3AAQAKIEgH5wOz9NO5PStU46rmbXzsJbTOzAYU5i4bqwST5fnMEGcYBCC_26C4BjABOgS9RxseQgSpYiFN.0hnr%2BLvVHZSJcDItbwvYnZ5lqYc9HUW9fIuFla6%2B%2B4k
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_32 Value: 11175-AQAHM1F2HEaAFQJHR_bHAQEBAQEBAQCTdvO13wEBAJN287Xf&KRTB&22715-AQAHM1F2HEaAFQJHR_bHAQEBAQEBAQCTdvO13wEBAJN287Xf&KRTB&23519-AQAHM1F2HEaAFQJHR_bHAQEBAQEBAQCTdvO13wEBAJN287Xf&KRTB&23632-AQAHM1F2HEaAFQJHR_bHAQEBAQEBAQCTdvO13wEBAJN287Xf
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_860 Value: 16335-sx_LePmIVptSXsWT24G_jAW16oY&KRTB&23334-sx_LePmIVptSXsWT24G_jAW16oY&KRTB&23417-sx_LePmIVptSXsWT24G_jAW16oY&KRTB&23426-sx_LePmIVptSXsWT24G_jAW16oY
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_1278 Value: 23329-9f854bd9-d180-488e-9051-42dbe22f5589&KRTB&23340-9f854bd9-d180-488e-9051-42dbe22f5589&KRTB&23498-9f854bd9-d180-488e-9051-42dbe22f5589
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_22 Value: 14911-3417573957596807279&KRTB&23150-3417573957596807279&KRTB&23527-3417573957596807279&KRTB&23629-3417573957596807279
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_279 Value: 22890-93df7d63-4f76-4711-b2a9-784c73bae89d&KRTB&23011-93df7d63-4f76-4711-b2a9-784c73bae89d&KRTB&23355-93df7d63-4f76-4711-b2a9-784c73bae89d
.onworks.net/	1970-01-21 04:29:01	Name: __eoi Value: ID=c24d1d8304adf292:T=1728589246:RT=1728589246:S=AA-AfjYAOy1UO5Ckiqj1xCcDo2B9
.w55c.net/	1970-01-21 00:53:01	Name: matchtriplelift Value: 5
.onworks.net/	1970-01-21 09:31:25	Name: cto_bundle Value: 7_2CM18xbiUyRnUwUXVaSmxVa2F6b0JiQmRicElYWTNQMlpuVmE5TTZOSVNsVnRFMmk0cDlsZ3V0cUx3aVFTVVVlJTJGeHlxcXdsZW94SlpuZ3Z4RDZ4OUliQnQ0em0lMkJVMExFRXU1NU1OQkVLNXA3SmhpTlhHdXB4eUl0Q3dHTDJDMTg3VFNyanFhVkJGeHVhSyUyRk1Udlp0WlNldGg4dyUzRCUzRA
.w55c.net/	1970-01-21 00:53:01	Name: matchpubmatic Value: 5
.ymmobi.com/	1970-01-21 08:48:13	Name: ym_user_cookie Value: ym_user_4c30e4ab-7dd5-40dd-958e-195142062ae5
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_27 Value: 16735-uid:f9a66708-2dc0-4e00-a062-2e9ba76e4fe7
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_153 Value: 19420-33lsS9sqPhXELz5E2SpxQ4h2aEPEejgV3S3wgCRz&KRTB&22979-33lsS9sqPhXELz5E2SpxQ4h2aEPEejgV3S3wgCRz&KRTB&23462-33lsS9sqPhXELz5E2SpxQ4h2aEPEejgV3S3wgCRz
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_148 Value: 19421-uid:15F3D6D3B6784FC089A101AF144FAC5D&KRTB&23486-uid:15F3D6D3B6784FC089A101AF144FAC5D&KRTB&23489-uid:15F3D6D3B6784FC089A101AF144FAC5D&KRTB&23539-uid:15F3D6D3B6784FC089A101AF144FAC5D
.bidr.io/	1970-01-21 09:38:22	Name: bitoIsSecure Value: ok
.bidr.io/	1970-01-21 09:38:22	Name: bito Value: AAM0VU7OEFsAABUvhpjfdg
.thrtle.com/	1970-01-21 04:57:49	Name: mc Value: eyJpZCI6ImFmOGI3MzE4LWQ4OTEtNDFmNS1hMmRlLTI4NmU2OWUwNmU5NiIsImwiOjE3Mjg1ODkyNDc3NjQsInQiOjF9
.bing.com/	1970-01-21 09:31:25	Name: MUID Value: 20078FF89636670B05739AEC97546619
.rfihub.com/	1970-01-21 09:31:25	Name: rud Value: H4sIAAAAAAAA_-MSNrQ0NzYysLQ0tzS1sLQ0NjM1NxfiM9RNMXbLqvLIdC0ucAkCAItG4kAlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNrQ0NzYysLQ0tzS1sLQ0NjM1NxfiM9RNMXbLqvLIdC0ucAkCAItG4kAlAAAA
.tribalfusion.com/	1970-01-21 02:19:25	Name: ANON_ID Value: aunoeUwl6hnbQQw9RC9uv3gE7PVa2wUTF0FTAZcvT
beacon.lynx.cognitivlabs.com/	1970-01-21 08:55:25	Name: UID Value: 85f7e3a4-c47e-475c-b920-70e519dab0af
beacon.lynx.cognitivlabs.com/	1970-01-21 08:55:25	Name: ss Value: t6JP%2Fz3i%2Bqwzz14H%2FuWF9dDmse66dCcG4iMSKSDrFVgkkxoRBvTB5cEO4IVRpW8eZzgNejXz04VL37oyesVyHw%3D%3D
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_107 Value: 1471-uid:Vk5rFk2N1SYZ1J5&KRTB&23421-uid:Vk5rFk2N1SYZ1J5
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_188 Value: 3189-895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&KRTB&23418-895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553&KRTB&23634-895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_18 Value: 22947-1973209979589936577&KRTB&23628-1973209979589936577
.adx.opera.com/	1970-01-21 08:55:25	Name: UID Value: OPU76d0c5fc21064c1db21580eec28e7c29
.pubmatic.com/	1970-01-21 00:29:58	Name: KRTBCOOKIE_1323 Value: 23480-OPU76d0c5fc21064c1db21580eec28e7c29&KRTB&23485-OPU76d0c5fc21064c1db21580eec28e7c29&KRTB&23524-OPU76d0c5fc21064c1db21580eec28e7c29&KRTB&23575-OPU76d0c5fc21064c1db21580eec28e7c29
.linkedin.com/	1970-01-21 02:19:25	Name: li_sugr Value: d912ec77-0ea2-4b8a-8900-03025128f921
.linkedin.com/	1970-01-21 08:55:25	Name: bcookie Value: "v=2&d3e8f4d2-1f28-404b-8802-0fb74adf1466"
.richaudience.com/	1970-01-21 00:53:01	Name: pdid Value: 32de5094-6a68-4446-88e9-1zz1728589247
.mxptint.net/	1970-01-21 09:45:49	Name: mxpim Value: R33647_11D320ED8_886A9771.1.000000000000000067082DBF
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_52 Value: 22772-R33647_11D320ED8_886A9771&KRTB&23092-R33647_11D320ED8_886A9771
.media.net/	1970-01-21 08:55:25	Name: visitor-id Value: 3715908480813460000V10
.media.net/	1970-01-21 08:55:25	Name: data-pbs Value: setstatuscode~~1
.rubiconproject.com/	1970-01-21 02:19:25	Name: receive-cookie-deprecation Value: 1
.googleadservices.com/	1970-01-21 02:19:25	Name: ar_debug Value: 1
.lijit.com/	1970-01-21 08:55:25	Name: _ljtrtb_80 Value: M23PENVM-15-LWDL
.creativecdn.com/	1970-01-21 08:55:25	Name: ts Value: 1728589248
.deepintent.com/	1970-01-21 09:45:49	Name: CDIPARTNERS Value: %7B%22140%22%3A%2220241010%22%2C%221%22%3A%2220241010%22%7D
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_699 Value: 22727-AAM0VU7OEFsAABUvhpjfdg
.omnitagjs.com/	1970-01-21 00:53:01	Name: ayl_visitor Value: 70484898637ea125bb326df062d03db9
.rfihub.com/	1970-01-21 09:31:25	Name: eud Value: H4sIAAAAAAAA_9vEyGtobmRhamFpZGJubmL4SBDBtzCxMAQAThg5ByAAAAA
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_632 Value: 23041-8DURlSdPkSkX8iNSGnfoVWxTsht22Z29nepV7oOt-xY&KRTB&23047-8DURlSdPkSkX8iNSGnfoVWxTsht22Z29nepV7oOt-xY&KRTB&23234-8DURlSdPkSkX8iNSGnfoVWxTsht22Z29nepV7oOt-xY&KRTB&23361-8DURlSdPkSkX8iNSGnfoVWxTsht22Z29nepV7oOt-xY
.open-adsyield.com/	1970-01-21 00:53:01	Name: lluid Value: 20902f41-ae39-4be2-560e-7857c0fd0c79
.pbs.yahoo.com/	1970-01-21 04:31:54	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJ0cmlwbGVsaWZ0Ijp7InVpZCI6IjU1NzgwNTIzMjc1NDEwNDg2MDgzNSIsImV4cGlyZXMiOiIyMDI0LTEwLTI0VDE5OjQwOjQ4LjU3NDgyMzI0NFoifX19
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_391 Value: 22924-7492511013085685528&KRTB&23231-7492511013085685528&KRTB&23263-7492511013085685528&KRTB&23481-7492511013085685528
.creativecdn.com/	1970-01-21 08:55:25	Name: g Value: 89XbU0xRjexzd2HOnmdt_1728589248594
.aidemsrv.com/	1970-01-21 00:09:51	Name: __cf_bm Value: j.Jkp3utUc1wvOsWsop5BNgIhrHkbYfJbqJBphxK_.0-1728589248-1.0.1.1-7vrTDGgPTomzCv.2lkw.iPj3nOnLWC3ndgMJ1SH1grbf3r42PlEd2bZwkqkU.oH9DxwCbqAGZn5cuuVe_evM6w
.tapad.com/	1970-01-21 01:36:13	Name: TapAd_TS Value: 1728589248679
.tapad.com/	1970-01-21 01:36:13	Name: TapAd_DID Value: da50142f-1baa-4d9f-acb8-c94944ef4ff6
.mfadsrvr.com/	1970-01-21 08:55:25	Name: c Value: 1728589248
.mfadsrvr.com/	1970-01-21 08:55:25	Name: tuuid_lu Value: 1728589248
.yellowblue.io/	1970-01-21 00:53:01	Name: wrvUserID Value: 6VdWeyprC
.postrelease.com/	1970-01-21 08:55:25	Name: status Value: 0
.33across.com/	1970-01-21 08:55:25	Name: 33x_ps Value: u%3D212830299437828%3As1%3D1728589248760%3Ats%3D1728589248760
.shb-sync.com/	1970-01-21 00:29:58	Name: smart_usr Value: 2f354973-8428-434b-8ea7-4b9443382dca
.shb-sync.com/	1970-01-21 00:29:58	Name: smart_r Value: 32906
.doubleclick.net/	1970-01-21 00:09:52	Name: DSID Value: NO_DATA
.primis.tech/	1970-01-21 00:45:49	Name: csuuid Value: 67082dc0c3806
.adkernel.com/	1969-12-31 23:59:59	Name: DSP2F_40 Value: 508546
.go.sonobi.com/	1970-01-21 08:55:25	Name: __uis Value: 2cdbf639-4237-402a-8ff5-9f416c807f49
.lijit.com/	1970-01-21 08:55:25	Name: ljtrtb Value: eJyrVjI0MFKyUjI0TjY0TjEx17U0TkvRNU00T9JNTEm11DVLS7NINTUwTEpLTFPSUbIwAKr1NTIOcPUL89U1NNX1CXfxUaoFAHeMEgk%3D
.lijit.com/	1970-01-21 08:55:25	Name: _ljtrtb_102 Value: 3670a19c-fa9e-5b60-89e7-44a6a73ba87d
.mfadsrvr.com/	1970-01-21 08:55:25	Name: tuuid Value: d5f41a65-9430-46d6-be2b-4cf25bedbd84
.connatix.com/	1970-01-21 00:53:01	Name: cnx_userId Value: 50c7326337134785b1085561ad18abd0
.openwebmp.com/	1970-01-21 00:53:01	Name: wrvUserID Value: QceWemp9Cp_ow
.media.net/	1970-01-21 08:55:25	Name: data-ris Value: {{APID}}~~25
.postrelease.com/	1970-01-21 08:55:25	Name: visitor Value: ecbcc4f5-1f22-4ad3-bc48-1a47d079194a
.company-target.com/	1970-01-21 09:45:49	Name: tuuid Value: 7af3d1d6-011b-4452-9d1b-6fa7140e9aaf
.yieldmo.com/	1970-01-21 08:55:25	Name: yieldmo_id Value: Veew6FFupwF1szhVAbLb%7C1728518400000%7C0
.smaato.net/	1970-01-21 00:40:03	Name: SCM Value: acff26fe62
.smaato.net/	1970-01-21 00:40:03	Name: SCMrise Value: acff26fe62
.storygize.net/	1970-01-21 09:45:49	Name: U Value: af9670b3-5a03-47bd-91d1-a4b21a9c5b2f
.mfadsrvr.com/	1970-01-21 08:55:25	Name: ssh Value: !adyoulike=1728589249
.open-adsyield.com/	1970-01-21 08:55:25	Name: llum Value: eyJhZHkiOnsiNSI6MTcyODU4OTI0ODU1NiwiNCI6MTcyODU4OTI0OTE4Mn19
.pubmatic.com/	1970-01-21 02:19:25	Name: SyncRTB4 Value: 1729382400%3A63%7C1729814400%3A35_268%7C1733702400%3A69%7C1729123200%3A223_2_38_15%7C1731110400%3A224%7C1728950400%3A216%7C1729728000%3A22_54_8_238_264_55_46_266_48_7_272_233_71_81_250_104_13_165_176_214_243_267_220_178_3_21_201_99_271_231_249_166_5_234_96_56_240
.postrelease.com/	1970-01-21 08:55:25	Name: ver Value: 1
.resetdigital.co/	1970-01-21 02:19:25	Name: ckbk Value: 0000015F01512FE9
.go.sonobi.com/	1969-12-31 23:59:59	Name: HAPLB8G Value: s86119\|Zwgtx
.aniview.com/	1970-01-21 00:53:01	Name: aniC Value: 8f32cba9-affd-4720-8d77-f69b50d74f48
sync.aniview.com/	1970-01-21 00:53:01	Name: aniC Value: 8f32cba9-affd-4720-8d77-f69b50d74f48
.aniview.com/	1970-01-21 00:24:13	Name: 1_C_24 Value:
sync.aniview.com/	1970-01-21 00:24:13	Name: 1_C_24 Value:
.aniview.com/	1970-01-21 00:24:13	Name: 1_C_18 Value: JeYcAQZHYBxODIdtQQy1Xqdw
sync.aniview.com/	1970-01-21 00:24:13	Name: 1_C_18 Value: JeYcAQZHYBxODIdtQQy1Xqdw
.aniview.com/	1970-01-21 00:24:13	Name: 1_C_204 Value: 913ef43a-4ef2-4594-8e61-d4ea016ad811
sync.aniview.com/	1970-01-21 00:24:13	Name: 1_C_204 Value: 913ef43a-4ef2-4594-8e61-d4ea016ad811
.intentiq.com/	1970-01-21 09:45:49	Name: intentIQ Value: f9SV5oV4ge
.intentiq.com/	1970-01-21 09:45:49	Name: IQver Value: 1.9
.bttrack.com/	1970-01-21 02:19:25	Name: GLOBALID Value: 2uKlc8-sIBd984cSkDr2HtTK9bfyvdiPDPNsUy_8V2u3wBN2hzfiflzkRJG0PHddT5ZeRPDesrMC4Q2
.rubiconproject.com/	1970-01-21 08:55:25	Name: khaos Value: M23PENVM-15-LWDL
.rubiconproject.com/	1970-01-21 08:55:25	Name: khaos_p Value: M23PENVM-15-LWDL
.bidswitch.net/	1970-01-21 08:55:25	Name: tuuid Value: 2ca2151c-3bc8-43cc-8325-705d5f8078c3
.bidswitch.net/	1970-01-21 08:55:25	Name: c Value: 1728589249
.bidswitch.net/	1970-01-21 08:55:25	Name: tuuid_lu Value: 1728589249
.adsby.bidtheatre.com/	1970-01-21 00:19:54	Name: __kuid Value: 3c1e4e11-b079-4b84-8ec9-bf75377d77b8.497803249
.intentiq.com/	1970-01-21 09:45:49	Name: IQPData Value: 95808134#1728589249558#0#1728589249558
.intentiq.com/	1970-01-21 09:45:49	Name: CSDT Value: UEQ6MTUxMDZfMCZVUXBjS1Y3
.intentiq.com/	1970-01-21 09:45:49	Name: ASDT Value: 0
.intentiq.com/	1970-01-21 09:45:49	Name: intentIQCDate Value: 1728589249560
.getpublica.com/	1970-01-21 01:36:13	Name: p_uid Value: 28f0aa84-bf00-4487-868b-b3cedf7c217d
.tynt.com/	1970-01-21 08:55:25	Name: uid Value: OY/j22cILcGn+sRSJaf60Q==
.pippio.com/	1970-01-21 08:55:25	Name: didts Value: 1728589249
.pippio.com/	1970-01-21 01:36:13	Name: nnls Value:
.pippio.com/	1970-01-21 01:36:13	Name: pxrc Value: CMHboLgGEgYIgr0rEAA=
.pippio.com/	1970-01-21 08:55:25	Name: did Value: QFBW77wl4ayoueok
.casalemedia.com/	1970-01-21 02:19:25	Name: CMPS Value: 1240
.casalemedia.com/	1970-01-21 08:55:25	Name: CMID Value: ZwgtwdHM6JkAADZeAACslAAA
.casalemedia.com/	1970-01-21 02:19:25	Name: CMPRO Value: 3401
.aniview.com/	1970-01-21 00:24:13	Name: 1_C_72 Value: 895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553
sync.aniview.com/	1970-01-21 00:24:13	Name: 1_C_72 Value: 895f1bd0-ae18-4f3e-8b50-fc639b59670e-67082dbf-5553
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_594 Value: 17105-OPTOUT&KRTB&17107-OPTOUT
.id5-sync.com/	1970-01-21 02:19:25	Name: id5 Value: 8f4747d9-808c-70c6-9bc2-7249814269e1#1728589247082#2
.smaato.net/	1970-01-21 00:40:03	Name: SCMsas Value: acff26fe62
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_1199 Value: 23168-0000015F01512FE9&KRTB&23175-0000015F01512FE9
.company-target.com/	1970-01-21 09:45:49	Name: tuuid_lu Value: 1728589250\|eqx:0\|tlx:0
.sitescout.com/	1970-01-21 00:53:01	Name: _ssuma Value: eyI0NSI6MTcyODU4OTI0Nzc2NCwiMTciOjE3Mjg1ODkyNTAxMjcsIjM5IjoxNzI4NTg5MjQ5Mzk0LCI3IjoxNzI4NTg5MjQ5Mzk0LCI3NCI6MTcyODU4OTI0OTM5NCwiMTAiOjE3Mjg1ODkyNDk3NjF9
.demdex.net/	1970-01-21 04:29:01	Name: demdex Value: 07210482814945383922198062897837737732
.mobfox.com/	1970-01-21 00:29:58	Name: mf_u_key Value: c017f883-0686-425f-8f94-2e0bbafbffa4
.dpm.demdex.net/	1970-01-21 04:29:01	Name: dpm Value: 07210482814945383922198062897837737732
.rlcdn.com/	1970-01-21 08:55:25	Name: rlas3 Value: sJpssYo8BVEPP9+4jR+FI932KBYXZxazIDPn6j8oBqk=
.pubmatic.com/	1970-01-21 02:19:25	Name: chkChromeAb67Sec Value: 15
.pubmatic.com/	1970-01-21 02:19:25	Name: DPSync4 Value: 1729728000%3A263_219_260_228_235_226_245_258_259_236_197_261_256_262%7C1729123200%3A164_252_265%7C1729555200%3A257%7C1728604800%3A255_248
.krushmedia.com/	1970-01-21 00:29:58	Name: krm_r Value: 489\|52\|636\|227\|615
.aniview.com/	1970-01-21 00:24:13	Name: 1_C_5 Value: M23PENVM-15-LWDL
sync.aniview.com/	1970-01-21 00:24:13	Name: 1_C_5 Value: M23PENVM-15-LWDL
.quantserve.com/	1970-01-21 02:19:25	Name: sp Value: CggIiQ0SAxDPDQoJCOirBhIDEM8NCgkIgq0DEgMQzw0=
.contextweb.com/	1970-01-21 08:55:25	Name: pb_rtb_ev Value: 3-1u4e\|80p.0.1\|7GB.0.1\|7br.0.1\|8nM.0.1\|7dN.0.AAM0VU7OEFsAABUvhpjfdg\|8i8.0.1
.contextweb.com/	1970-01-21 08:55:25	Name: pb_rtb_ev_part Value: 3-1u4e\|80p.0.1\|7GB.0.1\|7br.0.1\|8nM.0.1\|7dN.0.AAM0VU7OEFsAABUvhpjfdg\|8i8.0.1
.ads.pubmatic.com/	1970-01-21 00:11:15	Name: pubsyncexp Value: 1728610850888
.tapad.com/	1970-01-21 01:36:13	Name: TapAd_3WAY_SYNCS Value: 1!6835
.rlcdn.com/	1970-01-21 01:36:13	Name: pxrc Value: CMHboLgGEgUI6EcQABIGCLrqARABEgYIwuoBEAESBgi46wEQAQ==
.adotmob.com/	1970-01-21 04:29:01	Name: uid Value: 0b17200500486ad70d1685c7
.adotmob.com/	1970-01-21 04:29:01	Name: uuid Value: 0b17200500486ad70d1685c7
.adotmob.com/	1970-01-21 04:29:01	Name: partners Value: SMA%3A1728589250963
.realestate.com.au/	1970-01-21 09:45:49	Name: mid Value: 12631772603952643813
.admixer.net/	1970-01-21 02:19:25	Name: am-uid Value: 1926453ba6634c99b09b7621576eb2a5
.pxl.iqm.com/	1970-01-21 00:31:25	Name: iqm.retarget.uid Value: f408c218-d07d-4017-bc89-ccb8963fbf78
.kargo.com/	1970-01-21 08:55:25	Name: ktcid Value: d5733bc9-c09d-04ae-5e2b-277bb2ab5b47
.adgrx.com/	1970-01-21 09:38:37	Name: ADGRX_UID Value: 8e51abda-873f-11ef-8201-c855ef18e568
.iqzone.com/	1970-01-21 00:29:58	Name: iq_u_key Value: c4c338e8-34c1-41a9-93a2-565e1f150474
.owneriq.net/	1970-01-21 00:24:13	Name: p2 Value: pmc
.owneriq.net/	1970-01-21 09:45:49	Name: si Value: Q7818756511206696652P
.owneriq.net/	1970-01-21 00:24:13	Name: pmc Value: 1
.rqtrk.eu/	1970-01-21 00:19:54	Name: browser_id Value: 1:86cea63f-a38d-4bb8-8744-857755036f1e
.ctnsnet.com/	1970-01-21 08:55:25	Name: cid_1d9334c2323b457497aac5d4f340017c Value: 1
.adgrx.com/	1970-01-21 00:11:15	Name: ADGRX_CM_PUBMATIC_BRIDGED Value: 1
.smaato.net/	1970-01-21 00:40:03	Name: SCMaps Value: acff26fe62
.smaato.net/	1970-01-21 00:40:03	Name: SCM1002222 Value: acff26fe62
.dotomi.com/	1970-01-21 00:09:49	Name: DotomiTest Value: 5678acdc48e41153
.mobfox.com/	1970-01-21 00:29:58	Name: mf_red_key Value: 1007\|304\|16
.pubmatic.com/	1970-01-21 02:19:25	Name: KRTBCOOKIE_1003 Value: 22761-8e51abda-873f-11ef-8201-c855ef18e568&KRTB&23275-8e51abda-873f-11ef-8201-c855ef18e568
.realestate.com.au/	1970-01-21 08:55:25	Name: External Value: %2FTRIPLELIFT%3D557805232754104860835%2F_EXP%3D1760125250%2F_exp%3D1760125251
.iqzone.com/	1970-01-21 00:29:58	Name: iq_r_key Value: 277\|12
.pxl.iqm.com/	1970-01-21 00:53:01	Name: equativ Value: MTcyOTc5ODg1MTI3Nw==
.360yield.com/	1970-01-21 02:19:25	Name: tuuid Value: 94f2aebb-3dd4-4e00-aea5-7f9bed82ed85
.360yield.com/	1970-01-21 02:19:25	Name: tuuid_lu Value: 1728589251
prebid-stag.setupad.net/	1970-01-21 02:19:25	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJhZGZvcm0iOnsidWlkIjoiNzQ5MjUxMTAxMzA4NTY4NTUyOCIsImV4cGlyZXMiOiIyMDI0LTEwLTI0VDE5OjQwOjUwLjkxNzAzOTUwOFoifSwiZXBsYW5uaW5nIjp7InVpZCI6IkFDREl2UGFVN0MvTHVGLzgiLCJleHBpcmVzIjoiMjAyNC0xMC0yNFQxOTo0MDo1MS4yMzk2NzI2ODNaIn0sInJpc2UiOnsidWlkIjoiNlZkV2V5cHJDIiwiZXhwaXJlcyI6IjIwMjQtMTAtMjRUMTk6NDA6NTAuMDc2MDEyNzI3WiJ9LCJzbWFydGFkc2VydmVyIjp7InVpZCI6IjM5NjY0ODA3MTYwMTIxMDA4NTUiLCJleHBpcmVzIjoiMjAyNC0xMC0yNFQxOTo0MDo0OC4yNjYxNTE3MTVaIn19fQ==
.prebid-server.rubiconproject.com/	1970-01-21 00:29:58	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJ0cmlwbGVsaWZ0Ijp7InVpZCI6IjU1NzgwNTIzMjc1NDEwNDg2MDgzNSIsImV4cGlyZXMiOiIyMDI0LTEwLTI0VDE5OjQwOjUxLjI1MTIwODkwM1oifSwicnViaWNvbiI6eyJ1aWQiOiJNMjNQRU5WTS0xNS1MV0RMIiwiZXhwaXJlcyI6IjIwMjQtMTAtMjRUMTk6NDA6NTEuMjUxMTU5MzdaIn19fQ==
.tynt.com/	1970-01-21 02:19:25	Name: pids Value: %5B%7B%22p%22%3A%22797f54a72d%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%2C%7B%22p%22%3A%224ef5c9a86a%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%2C%7B%22p%22%3A%22cf4d6e49b5%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1728589251280%7D%5D
.metadsp.co.uk/	1970-01-21 08:55:25	Name: ruuid Value: 64db9011-457c-477d-a52e-a2e280ec3910
.metadsp.co.uk/	1970-01-21 08:55:25	Name: c Value: 1728589251
.metadsp.co.uk/	1970-01-21 08:55:25	Name: ruuid_lu Value: 1728589251
.smartadserver.com/	1970-01-21 08:55:25	Name: csync Value: 22:7492511013085685528\|31:2ca2151c-3bc8-43cc-8325-705d5f8078c3\|66:0b17200500486ad70d1685c7\|76:CAESEIlg16gd6mNriq6sEyKQ11I\|86:960377318026395464\|92:41r2Gmozn9Y5\|100:e0673f44-65e4-4f7b-8d80-7806f047ca8d\|111:ID5-9c21SKAgJYN6uJRFJApXeDYLI9h4yvXwo3W5gO6f5w\|113:OPTOUT\|127:AAM0VU7OEFsAABUvhpjfdg\|133:acff26fe62\|134:OB_OK\|135:TAM_OK\|147:6406cfd8-26c3-40ce-8369-4118afb5b61d\|152:7af3d1d6-011b-4452-9d1b-6fa7140e9aaf\|154:f408c218-d07d-4017-bc89-ccb8963fbf78\|155:AQAHJqb6L_UNqAIuCS_qAQEBAQEBAQCTdvPDywEBAJN288PL
.pubmatic.com/	1970-01-21 00:53:01	Name: SPugT Value: 1728589249
.eyeota.net/	1970-01-21 08:55:25	Name: mako_uid Value: 19277f2c3b4-1e100000010a57c8
.eyeota.net/	1970-01-21 00:09:49	Name: SERVERID Value: 22472~DM
.server.cpmstar.com/	1970-01-21 09:31:28	Name: USER_ID Value: %eb%c7%87%d0%fc%b7%b1%f30%e9N%f0I5%88
.pubmatic.com/	1970-01-21 00:53:01	Name: KRTBCOOKIE_904 Value: 23554-ftSQuvSbCSWZAecZwy0IZw&KRTB&23557-ftSQuvSbCSWZAecZwy0IZw&KRTB&23586-ftSQuvSbCSWZAecZwy0IZw
.pubmatic.com/	1970-01-21 00:53:01	Name: PugT Value: 1728589250
.id5-sync.com/	1970-01-21 02:19:25	Name: 3pi Value: 2#1728589250070#-787814179#960377318026395464\|102#1728589249916#-1067812478\|264#1728589250224#290495884#d565ed3f-30bc-4e74-8e23-a65db5ef6e12\|155#1728589250352#-866450094#AAM0VU7OEFsAABUvhpjfdg\|123#1728589251653#-266133839
.agkn.com/	1970-01-21 08:55:25	Name: ab Value: 0001%3AMlw7GT12Bc8fWp5KJg0oxRLKBPr%2FovfO
io.narrative.io/	1970-01-21 09:45:49	Name: io.narrative.guid.v2 Value: 8eb10530-873f-11ef-82f8-00000a0ffa4e
.sportradarserving.com/	1970-01-21 08:53:58	Name: zuuid Value: ca5b6517-6099-4e01-a31e-4549f8a6b485
.sportradarserving.com/	1970-01-21 08:53:58	Name: c Value: 1728589251
.sportradarserving.com/	1970-01-21 08:53:58	Name: zuuid_lu Value: 1728589251
.onaudience.com/	1970-01-21 08:55:25	Name: cookie Value: e47e52db9cd52ff7
.onaudience.com/	1970-01-21 00:11:15	Name: done_redirects252 Value: 1
.sportradarserving.com/	1970-01-21 08:53:58	Name: zuuid_k Value: 1
.sportradarserving.com/	1970-01-21 08:53:58	Name: zuuid_k_lu Value: 1728589251
.analytics.yahoo.com/	1970-01-21 08:55:25	Name: IDSYNC Value: "18z8~2l6j:190u~2l6j:199z~2l6j"
.rubiconproject.com/	1970-01-21 08:55:25	Name: audit_p Value: 1\|cv62zFMvoo9TEuo/+Z//9WduejoFGMbJvSVkahJ+5kDRuZ+dvyOZuOOpSNcCTlt1Cb+EhBXc8gxS8G+dhi1GhVEzNmZkqoUp
.rubiconproject.com/	1970-01-21 08:55:25	Name: audit Value: 1\|cv62zFMvoo9TEuo/+Z//9WduejoFGMbJvSVkahJ+5kDRuZ+dvyOZuOOpSNcCTlt1Cb+EhBXc8gxS8G+dhi1GhVEzNmZkqoUp
.onaudience.com/	1970-01-21 00:11:15	Name: done_redirects147 Value: 1
.adsrvr.org/	1970-01-21 08:55:25	Name: TDCPM Value: CAESFgoHc3Z4OXQ1MBILCIj514av27Q9EAUSFwoIcHVibWF0aWMSCwja3r6Hr9u0PRAFEhYKB3J1Ymljb24SCwigt4aNr9u0PRAFEhcKCGxpdmVyYW1wEgsI-Jupo6_btD0QBRIYCgliaWRzd2l0Y2gSCwjMyeylr9u0PRAFEhQKBXRhcGFkEgsI9sqnqa_btD0QBRgBIAEoAjILCK68nuLF27Q9EAU4AVoHeGtzdzlsYWAC
.onaudience.com/	1970-01-21 00:11:15	Name: done_redirects219 Value: 1
.adxpremium.services/	1970-01-21 02:19:25	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJ0cmlwbGVsaWZ0Ijp7InVpZCI6IjU1NzgwNTIzMjc1NDEwNDg2MDgzNSIsImV4cGlyZXMiOiIyMDI0LTEwLTI0VDIxOjQwOjQ5LjU4ODY0Mjc0OCswMjowMCJ9fSwiYmRheSI6IjIwMjQtMTAtMTBUMjE6NDA6NDkuNTg4NjQwMjQ3KzAyOjAwIn0=

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.onworks.net/push/getpaypal.php?email= Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fwww.onworks.net%2Fonworkssession.php Message: Failed to load resource: the server responded with a status of 400 ()
javascript	warning	URL: https://www.onworks.net/onworkssession.php Message: The resource https://www.onworks.net/images/24.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
network	error	Message: A bad HTTP response code (500) was received when fetching the script.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0f3cf97f346d5823aea8cfa81ace6d3c.safeframe.googlesyndication.com
57fdf00c9d3c2561dfff8fbbd7969d7e.safeframe.googlesyndication.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.turn.com
ads.us.e-planning.net
adx2.adform.net
adxbid.info
af14a3106c7f7b76a1d3b26880ac9e71.safeframe.googlesyndication.com
ba03819abf5510eeb782ebc280867717.safeframe.googlesyndication.com
bcp.crwdcntrl.net
bidder.criteo.com
c1.adform.net
cadmus.script.ac
cdn-ima.33across.com
cdn.ampproject.org
cdn.jsdelivr.net
cdn.prod.uidapi.com
cm.adform.net
cm.g.doubleclick.net
connectid.analytics.yahoo.com
csync.loopme.me
dis.criteo.com
downloads.uptoplay.net
e048355edcc66f0d1210caf6174bf6d5.safeframe.googlesyndication.com
e04fb87a7641e96f720548f0c3e74dca.safeframe.googlesyndication.com
eb2.3lift.com
equativ-match.dotomi.com
eu-u.openx.net
fonts.googleapis.com
fonts.gstatic.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
hb.yellowblue.io
ib.adnxs.com
id5-sync.com
images.onworks.net
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
mp.4dex.io
ms-cookie-sync.presage.io
mug.criteo.com
node.setupad.com
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pbs-cs.yellowblue.io
pixel-sync.sitescout.com
prebid-eu.creativecdn.com
prebid-stag.setupad.net
prebid.a-mo.net
prg.smartadserver.com
pxl.iqm.com
rtb-csync.smartadserver.com
rtb.adxpremium.services
s.ad.smaato.net
s.company-target.com
script.4dex.io
secure.adnxs.com
securepubads.g.doubleclick.net
server.cpmstar.com
ssbsync-global.smartadserver.com
ssum-sec.casalemedia.com
static.criteo.net
stpd.cloud
stream.onworks.net
sync.a-mo.net
tagan.adlightning.com
tags.crwdcntrl.net
tlx.3lift.com
tpc.googlesyndication.com
uipglob.semasio.net
ups.analytics.yahoo.com
web.hb.ad.cpe.dotomi.com
wt.rqtrk.eu
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.onworks.net
x.bidswitch.net
csync.loopme.me
googleads.g.doubleclick.net
pagead2.googlesyndication.com
prebid-stag.setupad.net
ssum-sec.casalemedia.com
uipglob.semasio.net
104.18.35.167
108.138.128.124
125.253.89.176
125.253.89.178
141.95.98.65
147.135.119.115
151.101.129.108
159.89.25.223
162.19.138.117
169.197.150.8
172.217.197.156
172.67.68.162
172.98.26.246
18.164.124.86
185.106.140.18
185.167.164.42
185.167.164.52
185.184.8.90
198.24.160.76
209.85.144.154
216.22.16.9
23.105.12.116
2600:1f18:765:4800:9d6a:a737:df26:4f81
2600:9000:20ed:8600:a:e047:754:afe1
2600:9000:24f1:f400:10:dd8:5e40:93a1
2600:9000:2840:6c00:1b:5138:8a40:93a1
2606:4700:20::681a:caa
2606:4700:20::ac43:4bf1
2606:4700:3030::ac43:8a0d
2606:4700:4400::6812:22b2
2606:4700::6812:1791
2606:4700::6812:1f31
2606:ae80:1451:11::2040
2606:ae80:1471:12::500
2607:f8b0:400d:c01::5e
2607:f8b0:400d:c01::84
2607:f8b0:400d:c02::9b
2607:f8b0:400d:c03::61
2607:f8b0:400d:c09::8b
2607:f8b0:400d:c0b::9c
2607:f8b0:400d:c0b::9d
2607:f8b0:400d:c0c::5e
2607:f8b0:400d:c0c::6a
2607:f8b0:400d:c0d::84
2607:f8b0:400d:c0e::9a
2607:f8b0:400d:c1d::5f
2620:100:a00b::12
2620:100:a00b::30
2620:100:a00b::4
2620:112:f008:200::101
2a02:c206:2202:9398::1
2a02:c206:2217:8560::1
2a04:4e42:400::485
3.171.139.30
3.208.132.83
3.225.218.10
3.232.0.61
3.233.167.98
34.102.146.192
34.120.135.53
34.36.216.150
34.96.70.87
34.96.71.22
35.211.202.130
35.244.159.8
35.71.139.29
37.157.6.237
51.222.241.106
52.2.246.163
54.158.240.101
54.211.170.34
67.220.226.233
68.67.160.75
74.119.117.16
74.119.117.17
026ff7e1018173d45536782ed3c52f1b88a6bfc95ee8f45bc662936c681f93e8
03335d5ee6b1eb3c22bf9b91b35a2d396188a28d52d685284d8c84e7be354ed6
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
0a4146becb1be37a2acf0f521fd3ae9fc2ac389542286c64900e67effdf572ff
101ead936a2281d53dcc064b7e2a2ab0d53b92ef3ef7b34b668673007895c860
101ffbc58574cf8ad9080605fe602a65cdc54445b6eebf60c87bac3fe31bf636
11fefb9c374d241b645ab5030176d8d2af1b3d362b31f20620848af9e0835ec4
14f29c0d1d5cb9f8871c929af419262d5b724aa2264ba2f47ee774c7b1740e0e
158bdeda69bcdd820b26b9f7c55a42af2b1985d8d0021c30ad914f253f7c26ad
1599a3b672ef5fd9937e1d3e8d6ec5051dfbdf10f96d155381602bcb05139658
1764e898369c24be8d7d1cbcb82079c27f3898fbc1883f388a5c1008dd30c9e8
1847a7853177bb197438a795b0b8d11c9b1ca76b6b0db356429cef6d5e07db75
194cd3ea6e7f8309628ecd20e923e2aa42a6b33ec48239e0532e38559877fdcd
1f55bcced5aba87a1628aaf5a33cea862e5f91501ee7e5e8bbd3d92aaa4487ce
1fc1571d6833cc5580555dfcec814405cb7bf33eea36f0dda5d43e0a95ba9b01
22980332555c7be92667fb0a19debdfaae56e965892c85b701fd5fe1eb206ade
2440da49abf00e2fc8e09c38bbb2ac1afca94303ead6974b746c79155c789b9b
246fef45b3c78c283fb603de040c9263bbb48532dcb057d4045a790b1b149318
24e077516b89f2a627c538ae9c18493ecd80f1fe367c0528c2cadc62d6601b6d
25377c3b5fdd6f4fe4b3e8f786d6e5a475b99f242487b52b81c0162e67ece722
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
259a116d793a035373e51dea42ed61220bae40bcf46e7811b017ce35dbb686fc
25b8f3aefaa2bbab5d6a50fdb519e28c7c5e68296ae272beb4a75aa46cc298f8
26dca3cd2ff32a9934a9fe12f32f973e38263f497e28ef43175d81b78af04be2
28bac19e2c9954e907755a04a23f54e66d170896802b32937d02835afc1aa3ab
2cda8e91f189fb5e7a5bfeedf249333086cd09c032613f048bf811cbb4967aa0
2d9162fe6e1560aa06a74bed237f9b2891517e0a27034da7d72376ad28644471
2dc709b4dea2a9dadc84302569a0025bf6d83761d446639490fe6ce6286bfca5
30b32e97f2e3e06deb742bf2e19daeb4f4657a956e836c2a25a7df2bc72f7500
31fd78934db81217de98d6d2ea6686f40e9057c4a873d53a4d295f9996dc7cbd
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
382ae2ac9972307a8053b779883c2c6764e7a4c30648ed4e315653a8a0b7fb9b
388bf206c1a54aac2a0f643ea09aa7cd8735cb5eaa18632c4f88e44044f33e15
3a9d352adf1a55f69eee7b0e015677f65a366df95635d309e96dad40269efd8a
3ad9292f7844d507f33f4de3bf19577c9115a8b7bc807f989ab26b19e3c97fe7
3aec57ffa5c31e185202ddaa3b5b9d9872d4504f4546ab4eea1298baaf3c7cc7
3b5fbc8c60678327860e3c17852c1e9b75060ab03d9e82a73028cee5f181bf61
3b9055de4b7d6dd982c32df2f5e3ffb4bb9e205a23adf70f2d57db9a20d6e04a
3b9767e5d0bea4d284bb1e624cc6ee3244b13efedfe5424eb5140ef326511eb7
3db2e2d1bd15d8d17abee6356d7f9e1f937e557fd45b47f6a01e7d2a127f615b
3dc5c3307b9b9a11721bc963c6f44ba98bc586f2cd9740fb0b5064f5f79962cd
3ecac4be91775c27eedd45f4446f46b7cc36c8ae78b6398bf0d8c66a2d8bc214
403373b80c1d2910a851b3e95bda54a30923e94f67d15eceb8c53ade0055a04f
40fdf5c404861d6180ee4a7ece01b3037b475aa37f7c259c7702e90cbfcf3623
43aa1bc1ee9c2d20f7b759bacdc554c8f0587006fb3ad5b245946bc94bd77cd4
476654be617cd56c72e542c68b4408831b14d132ca8805d27fcfab596d9f9091
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
4a5fb637292a28d7bb57ca7bbce22fbb12d283d3d0ab3aaeb59fcae0a96e0713
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f1582134128745f50ee71dc17905d537c6492c26347a6635a837b84d957057a
4fc8881adafb71daa5650a87aafda08ec27282a8e4f4ecad9d8ed768ea650f94
50f17262769a2476f090fd24ef33caffed8acd6caf684b20bdc90909c5c43758
5170090c12786262fcefb3b3cc01e110e0680001381ffb1f3b1c6a3d4b0d996c
52de3fb37e167bc691b7233a515bda92daee4d136e081ec14876f571fa8355d1
543c5adf9bd8c3b8db6eb0e512248483b0d7317bb7ad46f152b5f7d0474914a8
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996
56fdceec363758833100b58312eb4993fe9f599ca70117325ccbabe03b7d6d26
580c2ff7239a7dd16688cca1abb4397228a8189b89c775f9e82a1d4357d4b605
5c44c3e0ae02211d4c81a933e5f1c04c27e7925ccb45ea8d478da62555aeaa71
5d74e05640fae0737ed74af2712a68edfaefbd508f6ea29ccb21e95d6680407a
5e8020e3d61bfee03a48ca66498521053b0bdcc1a3d8791250ac9bf0f768cbf2
639ff68a2385af8033b2211dcdf847b85f34b87f13d09eec01ee2fd02a21712d
63a8ed4d42e2e14d5eeb92b559c0942083d03c633e8aa8d82511b06057b5790c
66776998b10e583a72f8fd29391a50e2c80eb3bc9a65b0dafe97e576d7d88507
6693bc43d302407eab5cc78d16e4cebc402e3cc1b5e185a05524ac3caab84054
6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bf15e61162bfc4ffefed3fbd18f21533f76a714ccc7b689e5eaa1a6763daa9a
712813ea22ce01143e99b9ddd631d7139fdbc557f0ec914740a976e1f0494022
7184ddec30d9950650b1ad4b0eaea892ca272465a60ce9f3ef49dab722e6756d
7262d54274ef0304ad875831934e874d1d148686d9f8e3646810113f23ec12af
72826aebfbd36b0946d90411b2eb52e7e54d8b002030abce5ee27dd51eadfacd
7322aee0de286cc14286157403e0a3b7943a1f62347e8f55ffc0190d70b0b669
7330191facb7e2ececc564f92a6e4db89028c010eb1d46114c19615354f02bd1
770ad859a362b5fbc8ad7a6ca102df4ed0630140d62282d405c22e73576d0cb1
773485acaee520be797ce2adbd1ae738c1c28b49b11e298ed784edbb11b08a2d
7c69058459fdf0b4521ba057f595d6aa938265ccf3095e818150886a7bb5bf44
7ee043e10ae70dbee32fbaa1ccedfbe1cf1accce7b9d557b0dfe2355f4ba28d1
7f23724578ef5fd406a791a5e03059827041c355d0ebd9081a5a740a16b95431
7f651bd7b6db2931357eeebaaa13b9d9c6aaf97c88dc9d45115ff5bbd7419e7d
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
80d07a03538fea0f39a9c73ae98ce4edd37c68db5dc4dfdd601b1556ab94bb6b
81ea22e6310b2238f0c937448a5e8b9f37c3e1aeee273dd3e4a5cff86bf34a6d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8606cc424a2fcd1d9e98bf7294238e2f8d9a4eda28e80fca5ffcbb50893885b1
87cc64769a62314612e92ffae77d8875a1efc1bbab37a294b336b7722aec9ef3
883dccb8109024ae995673839e1c01e65065c94edd01d121a0deea14830b255f
89f708f6ac0380dc8e47eef4a20294534850a3925d0ef6defa9a87d636b6a549
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a2ab36c83d5d55e311fbf787dbc7de0a17b89eb0b30b1772f518a79db334001
8de8824661201446be346fee8ad5d5e085018eab63187bdc64f23c9a48b61b3a
905c4ef33160a29cd7957ce9fa7f0a89baad1dc831f35920c147a6159619f285
90909d259afbaaa73f4accf86af27e03040ec2540cf1aca4a0a0e5aa8fbdc133
92ad0fdb8501fc67bc5a5e2127b06673b5241bad13f3b8c88287a73e9fa675da
95d29d8e3a8df165fab43d84e47fe4e57c95421caaa9509a6ed2c4fedbc34985
9888bfd6687c8d9c4ea30b45e0dd34f1619718b5d49c022a655ffae18849301c
99bf611b7d8147f4aee55dee27e9bf6c3ba870106206305c464525af5fdca22a
9a3272fdc40cb2636333e4ba1bd290adb9c78e01c7af4ae21da20a5cdf54b3b7
9bf164fd8f85bbe262753bca4167f5baacb295fa1f167e0dfcc43fbf3e21a876
9e5990d1ca2c462aa4bd70179996d8fb166050868c3f41ed77823c78be19079a
a0262d941852436e97f598c5dda0907b2ec3c22d57eba5c6280b4d3dd931fca5
a08376248bf75fc5ca4cac80799d1aa3590dd1b23c5f0aa1d9c2f6eb11e63dec
a106f7cfe3effdd38dce6866c34102c4f42f9f062c433f7cb28c8c207108f0e2
a1d3e256df52d65b37926880c3f18050fe8b81dd398f2d41c534636bec82db89
a1dc183a1e37c034f6528f4768d7912a229f7f25f9e4ed4ad283d0b1d7630551
a7abb4854de70e4e697f29a9be068c8d29192e38f4f392fb74a53703e1e5323d
aafd776ec37c9b47abb96dc3199c4dda7aff364fa6ec9f0458822793bee3e890
ab6729dad7252f905a0d5d5cb4f41034767f9084b4647354e87a37811e7b7230
ac6269919d4b13a28e2e95dcfadc1fa92ce58e406d22f4fed3bb4a0d8a378af1
af6077192f7a5e015bd8f1206acb1fc8b1fa35d5116ffe208fbc614dbfa09e21
b0d64e2593aa877b342b630ee9f4cab511fc5bc79c09d63c4af448a50e5d63fe
b1c2bd2fce91d330787c720e5d8bd1ad8cd01b2f274427450ae30c9341921418
b687694e242995d2ec7f35278d000d3d1ed995fe412e5b154fbb0e9526d0ef9a
b831ee2bbbdc5353833b35f1176feab0fe3d5a00c04c2576e7de866bced4a3c0
b87de489c3eda2d7cc12367ec2cd76c0bd53ff131e63b0068a92acab334a0227
ba73323eb12b60b9b147f3b349de2461174081846bd256015d6a4d91b5d5ccd4
bb4f293b5cba0602b0e0e1ace023aecea4e459131ba9f076b9a74434e625e095
bc4f319e08261c2f81bb1f96c1f674fd4a60924954dcc0376dfe57d01aa6bd73
bdb5fbbf823cdc9431ac0ac26c06d3106dbb27bed5297e1ff8a3da8d72a9bba9
c06f0ff3bff18094a91fb345b425c2d6cbac9fb8ea56f6db2e879cd49fa36510
c0bb478b61a1c97d3485a9075de3db15d34e1882a6af6c406516cb869097f859
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
c348cc05c0eb84eaf0e4b919ceb9515e08d5b4f10cca04b98149e1ea804c4b1d
c39e4d8a13eaa64be410564fe76f74f3e0f832401f579e3f497c38b854266a90
c7887c0f698d53558fa97c35fee57be8ef4c615a0b26d6d4f0daee6a6228c4bb
c84c0e919ae72b8ef9abd4d5f8f38bddffd185e571a13c9ab0de6be1391c3c64
cce7dd3ff1fe2f40cf5eba1143764463eb4a5a0f29a001994b4b16870e23a2fa
cd2e6effa8aef92397803fee376f460bf05870e2cdcf10b8cf1dadd45699f97a
cf7a26ecb0b35482b0f35ddd6e28fa91a0b109cf22a5953831c91234251651b3
d3ad390a4b5c59de9a338176f25616f7d5f11c6837119335fa0e1d872dc5a9b2
d3b2e215aa16c508ff50b076b82584ab9c2a86e52066d1fa12dceff1d1694437
d5b37b5a1c3dc069175225777a952f7ab33cd5415812e2b72910aae07392b609
d9a0694dd3537836a960a472a5ba8a4fe9a4ccdc95dc2eb4864c7d828e1996ad
dbe38f4d57612dbf1052c6481ab714771cb88b072c8c66127db2b12091575012
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de502ef16a7f705e8eff5b8ed0a82ab04ee8674eb4dfab14f8d2d310956df60b
de639f84f1d5b343cdf081027bec97d003b080eada14a038fb5e25b70502f3c1
dee69487058eef7ac867f6f2ba69fed81dce8c32e5adb55be9128611faf7957e
df3df65c756867b0839b6623e4561bdedaa569f3af5031caaf33670d5563e338
e2320f2452434b494e292e5a413126980c134215940ab091e9e496a0052d62f8
e2929281ec2f47f3b6f20549313374c66f14731a21cefb0b7f544491bdcb64b6
e388e19ca38c825b329e762c79c66bbd41bd334f18312c5e97fde0a8f64bca36
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c43be28112e056edd890214701ac10989800762cf74f55aafd84d622ad61f0
e4a7cc3f0133fbb6dbc3f3b2db0343a40d457f84200b4072d9d701d4c450af53
e4bf411611a715a5752d6e80345cd5fa56731a8ff96e54e5212024337a1c6984
e5513ed099fc87d7bd58e97895750876601852a5e12a75ba0afb7d6c33bd8508
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a
e687ea2f0b101508eb42841e23a305148562e615919a5c646aca1b753bd518a5
e9977e6290d6eb46a428fd34df0065423b48ffc3bc9a7767138eee523df70a32
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1143f9e51664becbfc711a82aabd0b1c8dd800c150e7cdcc259f9bb98312fd5
f1303ab66e7781fe03cfed1b5ec315232d15c838854d7a205be061977060826a
f53d180bc6394965a32e6bd8ddfd05d8bf69ae8239614e8cffa6b83e9b1ee90b
fac4c154d1bc897080c1de943b29bf9fd8ae2c4b0849ce4bb97d571d07124d10
fd0315a225ea9822dba8228c968f0f4e71610dbf6d433e2db0db1ce8660fdd36
fef0ae74dc3bcf89260cfe9fe70df333bb482dc7e52f129aa73b177426c72152
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

www.onworks.net Open in urlscan Pro 2606:4700:20::681a:caa Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

390 Requests

86 %HTTPS

41 %IPv6

56 Domains

87 Subdomains

61 IPs

8 Countries

1952 kBTransfer

10982 kBSize

273 Cookies

13 Outgoing links

Page URL History

Redirected requests

390 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.onworks.net Open in urlscan Pro
2606:4700:20::681a:caa Public Scan

Screenshot
Live screenshot

Full Image

390
Requests

86 %
HTTPS

41 %
IPv6

56
Domains

87
Subdomains

61
IPs

8
Countries

1952 kB
Transfer

10982 kB
Size

273
Cookies

390 HTTP transactions
1 data transactions